BITTER Expands Its Malware Arsenal with PapRAT

Summary

The South Asian cyberespionage group BITTER is conducting campaigns using custom remote access trojans (RATs) known as PapRAT and WmRAT. The attacks rely on multiple infection chains involving LNK files, VHDX images, and MSI installers to establish persistence and execute commands. The malware has also evolved from C++ implementations to more capable Rust-based variants.

Investigation

FortiGuard Labs analyzed three distinct attack chains targeting organizations across South Asia. The investigation identified abuse of LOLBins such as ftp.exe and curl, alongside different staging techniques designed to evade security controls. Malware analysis also uncovered XOR-encoded C2 configurations and a shift from C++ implants toward newer Rust-based malware.

Mitigation

Organizations should remain cautious when handling unsolicited LNK files, URL shortcuts, disk images, and MSI packages. Security teams should implement controls to detect suspicious execution chains, scheduled task creation, and unusual outbound C2 traffic. User awareness training focused on phishing lures and malicious attachments is also essential.

Response

When malicious activity is detected, isolate compromised hosts to prevent lateral movement and further command execution. Review scheduled tasks and MSI installation logs for unauthorized changes. Conduct forensic analysis of persistent artifacts such as err.log or talk.log, and inspect outbound network traffic for connections to identified or suspicious C2 domains.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to establish persistence on the victim machine to ensure their malicious payload executes every 30 minutes, facilitating a continuous connection to their Command and Control (C2) infrastructure. To blend in with legitimate system activity and evade simple signature-based detection, the attacker utilizes the native Windows schtasks.exe utility. They choose a deceptive task name, MicrosoftUpdatesupdates11678, mimicking a legitimate Windows update service to hide in plain sight within the Task Scheduler library.

• Regression Test Script:

  # Simulation script to trigger the specific detection rule
  # This script mimics the BITTER group's persistence mechanism.
  
  $TaskName = "MicrosoftUpdatesupdates11678"
  $Command = "cmd.exe /c echo 'C2 Beaconing Simulation'"
  
  Write-Host "[+] Attempting to create scheduled task: $TaskName" -ForegroundColor Cyan
  
  # Execute the command that matches the detection logic exactly
  # Logic looks for: schtasks.exe + /create + /sc minute + /mo 30 + task name
  schtasks /create /sc minute /mo 30 /tn "$TaskName" /tr "$Command" /f
  
  if ($LASTEXITCODE -eq 0) {
      Write-Host "[!] SUCCESS: Scheduled task created. Check SIEM for alert." -ForegroundColor Green
  } else {
      Write-Host "[-] FAILURE: Could not create task. Ensure you are running as Administrator." -ForegroundColor Red
  }

• Cleanup Commands:

  # Cleanup script to remove the simulated persistence
  $TaskName = "MicrosoftUpdatesupdates11678"
  
  Write-Host "[+] Removing scheduled task: $TaskName" -ForegroundColor Cyan
  schtasks /delete /tn "$TaskName" /f
  
  if ($LASTEXITCODE -eq 0) {
      Write-Host "[!] Cleanup successful." -ForegroundColor Green
  } else {
      Write-Host "[-] Cleanup failed. Manual removal required." -ForegroundColor Red
  }