Bitter Deploys PapRAT via LNK-MSI Chains Abusing ftp.exe and WebDAV
Bitter refined its access operations with flexible, low-detection chains delivering PapRAT. Evidence centers on specific C2 domains and command sets rather than attribution claims. The pattern underscores recurring configuration and monitoring failures across espionage and infrastructure targets.
The campaign relies on native Windows tools for initial execution: ftp.exe in scheduled tasks, VHDX-mounted LNKs launching Excel lures while installing PapRAT, and WebDAV URL shortcuts pulling additional LNKs. Recon data is staged as abc.pdf or talk.log before curl exfiltration. The Rust variant adds PowerShell and polling commands, reducing binary drops.
Fortinet telemetry shows the actor updating C2 scripts server-side to rotate commands without new payloads, a pattern seen in prior Bitter operations since 2020. No independent technical attribution beyond domain and malware overlap confirms state sponsorship despite multiple aliases listed.
This staging model exposes persistent gaps in endpoint monitoring of scheduled tasks and MSI behavior. Organizations treating LNK and VHDX files as low-risk repeat the same class of oversight that leaves default credentials on exposed industrial systems, enabling initial access that custom RATs then expand.
Next campaigns will likely incorporate additional script hosts and Rust variants within 90 days if current C2 infrastructure remains active.
Sources (2)
- [1]Fortinet FortiGuard Labs Bitter PapRAT Analysis(https://www.fortinet.com/blog/threat-research.html)
- [2]Recorded Future TA397 Infrastructure Tracking(https://www.recordedfuture.com/ta397-bitter-apt/)