Skip to navigation

Threat reportAPTTL-2026-5059

Bitter (TA397) Deploys PapRAT (C++ and Rust) via LNK, MSI/VHDX and RAR Chains Against South Asian Organizations

highACTIVE

FortiGuard Labs attributes with high confidence a cyber-espionage campaign to Bitter (TA397) that delivers a custom RAT, PapRAT, in C++ and Rust variants. Three delivery chains use diplomatic-themed lures: an LNK abusing ftp.exe, MSI packages inside a VHDX image, and a RAR with an internet shortcut that also fetches WmRAT.

Key facts for Bitter PapRAT espionage campaign

IdentifiersTL-2026-5059
Also known asPapRAT campaign
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows
AttributionHAZY TIGER (high confidence)
Nation-state nexusIndia
MalwarePapRAT, WmRAT, papsolutions
Toolscurl, ftp - S0095
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1033 System Owner/User Discovery, T1036.005 Match Legitimate Resource Name or Location, T1041 Exfiltration Over C2 Channel, T1053.005 Scheduled Task, T1057 Process Discovery, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Command and Scripting Interpreter, T1071.001 Web Protocols, T1082 System Information Discovery, T1083 File and Directory Discovery and 10 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, diplomatic, energy, engineering
Target regionsSouth Asia, Southeast Asia, south korea
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage for Bitter PapRAT espionage campaign

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5059 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bitter PapRAT Chain 1 - ftp.exe Script Execution via LNK (TL-2026-5059)

Detects the living-off-the-land stage of the Bitter (TA397) PapRAT campaign where a malicious LNK abuses the built-in ftp.exe with the -s: switch to run a command script that is disguised as an icon or image file. ftp.exe is almost never run with -s: scripts on modern endpoints, so this behaviour is a strong indicator of Indirect Command Execution (T1202) following user execution of a diplomatic-themed lure (T1204.002). Flags disguised script extensions and shell or explorer parents to help triage.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1202, T1204.002, T1059, T1036.005
  • Data sources: sysmon, windows_security
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (OriginalFileName="ftp.exe" OR Image="*ftp.exe")
| where match(CommandLine, "(?i)[[:space:]][-/]s:[^[:space:]]+")
| eval disguised_script=if(match(CommandLine, "(?i)[.](ico|png|jpg|jpeg|bmp|gif|txt|dat)"),1,0)
| eval lnk_launcher_parent=if(match(ParentImage, "(?i)(explorer|cmd|powershell|wscript|cscript)[.]exe$"),1,0)
| table _time host User ParentImage ParentCommandLine Image CommandLine disguised_script lnk_launcher_parent
| sort 0 - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "ftp.exe" or ProcessVersionInfoOriginalFileName =~ "ftp.exe"
| where ProcessCommandLine matches regex @"(?i)\s[-/]s:\S+"
| extend DisguisedScript = ProcessCommandLine matches regex @"(?i)\.(ico|png|jpg|jpeg|bmp|gif|txt|dat)\b"
| extend LnkLauncherParent = InitiatingProcessFileName in~ ("explorer.exe", "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DisguisedScript, LnkLauncherParent, SHA256

Sigma

title: Bitter PapRAT ftp.exe Script Execution via LNK
id: 3f6a1c92-8b47-4d15-a6e3-2c9d7b05e1a8
status: experimental
description: Detects ftp.exe launched with the -s switch to execute a script file, as used by the Bitter (TA397) PapRAT LNK chain where the script is disguised as an icon file.
references:
  - https://www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/
  - https://hackread.com/bitter-apt-fake-diplomatic-documents-paprat-spyware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
  - attack.defense-evasion
  - attack.t1202
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\ftp.exe'
    - OriginalFileName: 'ftp.exe'
  selection_script:
    CommandLine|contains:
      - ' -s:'
      - ' /s:'
  condition: all of selection_*
falsepositives:
  - Legacy automation or administrators using scripted ftp.exe transfers
level: high

Known false positives:

  • Legacy batch jobs or admin scripts that automate ftp.exe uploads with -s: script files
  • Software deployment tooling that scripts ftp.exe from a known service account

Tuning notes: Allow-list known service accounts and approved script paths used for scripted FTP. Raise priority when disguised_script=1 or the parent is explorer.exe (LNK double-click). Requires Sysmon EventCode 1 with OriginalFileName populated (Sysmon 10+); the Image wildcard covers older versions.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Bitter PapRAT MSI Installer Launch ([indicator] / [indicator]) · unlock with TL Creds
  • Bitter PapRAT Chain 1 System and AV Discovery with [indicator] Exfiltration · unlock with TL Creds
  • Bitter PapRAT Beaconing - High-Frequency Check-ins from Non-Browser Process · unlock with TL Creds
  • Bitter PapRAT Chain 3 - WebDAV-Delivered LNK Launch from Archive Internet Shortcut · unlock with TL Creds
  • Bitter PapRAT Implant Artifacts - papsolutions Product Name and [indicator] WmRAT · unlock with TL Creds
  • Bitter WmRAT C2 Network Activity - Port 47408 and [indicator] Connections · unlock with TL Creds
  • Bitter PapRAT Scheduled Task Persistence via Script and LOLBin Parents · unlock with TL Creds
  • Bitter WmRAT C2 Domain and IP Contact ([indicator] and Related Infrastructure) · unlock with TL Creds

Indicators of compromise for Bitter PapRAT espionage campaign

As of 2026-11-03, Threadlinqs Intelligence tracks 44 indicators of compromise for TL-2026-5059.

Sample indicators (3 of 44)

  • IP address: 38.180.142[.]228
  • Domain: netmansrvdns[.]com
  • File hash: 10cec5a84943f9b0c635640fad93fd2a2469cc46aae5e43a4604c903d139970f

Defanged, TLP:CLEAR. Full set of 44 indicators: unlock with TL Creds.

44 indicators of compromise · unlock with TL Creds. Compare plans

How Bitter PapRAT espionage campaign works

No software vulnerability is exploited.

FortiGuard Labs (researcher Cara Lin), as reported by Infosecurity Magazine and Hackread on 2026-11-02, describes a Bitter (TA397) espionage campaign against South Asian organizations (government, energy and engineering per Hackread), with additional telemetry in Southeast Asia and South Korea. Attribution to Bitter is high confidence, based on lure filenames, C2 patterns, file metadata and malware analysis. Bitter is described as a suspected South Asian group active since at least 2013. No CVE is exploited; all chains rely on user execution of diplomatic- and military-themed lures (bilateral meeting requests, an ambassador's letter referencing the 11th Belt and Road Summit, a 2026 gala dinner invitation).

Three delivery chains were identified. Chain 1 is a living-off-the-land chain: a malicious LNK abuses the built-in ftp.exe to launch scripts disguised as icon files, uses PowerShell, curl and scheduled tasks for persistence, collects system and antivirus information and sends it to the C2 in a file named abc.pdf, and shows a fake Windows error message as distraction. No traditional malware executable is deployed. Chain 2 uses a VHDX image (Letter from the Ambassador - 11th Belt and Road Summit.vhdx) containing a shortcut that opens a decoy spreadsheet while launching the MSI Visa_Details.msi in the background, installing PapRAT disguised as Microsoft software. Chain 3 uses a RAR archive containing an internet (URL) shortcut that retrieves an LNK over WebDAV, which launches Imp_Details.msi to deploy PapRAT; PapRAT then downloads a second implant, WmRAT, disguised as vnces.exe. WmRAT is a C++ RAT previously documented as a Bitter indicator and uses the C2 domain netmansrvdns.com.

PapRAT is a custom RAT with C++ and Rust variants. The C++ variant masquerades as a Microsoft component, XOR-encodes its C2 configuration with key 0x50, beacons over plaintext HTTP and supports eight commands including remote command execution, file operations/transfers, directory and drive listing, and screenshot capture. The Rust variant switches to HTTPS, conceals C2 strings with string reversal and ROT-3 shifts, and expands the command set to 11 by adding PowerShell execution, sleep/pause and clean exit; it waits 42 seconds before starting and checks in every 5 seconds. Build artifacts include product name 'papsolutions' and PDB file name requpap.pdb.

Sourcing caveats: the original FortiGuard report and the assigned Dark Reading article could not be retrieved, so this record relies on two secondary mirrors. Neither lists file hashes or C2 IP addresses. The BeaconBeagle lookup for netmansrvdns.com returned HTTP 502, so no C2 correlation is recorded. Sources differ slightly on the Rust command count details (Infosecurity: three added commands; Hackread: 8 to 11).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1202 Indirect Command Execution; T1218.007 Msiexec

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Command and Scripting Interpreter; T1204.001 Malicious Link; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Collection

T1113 Screen Capture

Initial Access

T1566.001 Phishing

Remediation for Bitter PapRAT espionage campaign

Immediate actions

  • Block netmansrvdns.com at DNS and web proxy and hunt for historical connections
  • Hunt for Visa_Details.msi, Imp_Details.msi, vnces.exe and the Belt and Road Summit VHDX lure across endpoints and mail gateways
  • Alert on ftp.exe executed with script/command arguments (e.g. via -s:) and on curl or PowerShell spawned from LNK files
  • Review scheduled tasks created recently by user-context processes

Workarounds

  • Block .lnk, .url, .vhdx and .msi attachments or nested archive content at the email gateway where business allows
  • Use AppLocker/WDAC to restrict msiexec installs from user-writable or mounted-image paths

Longer-term hardening

  • Restrict mounting of VHDX/ISO images from email and downloaded archives for standard users
  • Block or tightly control WebDAV egress and internet shortcut (.url) execution from archives
  • Deploy EDR with behavioral detection for LOLBin abuse (ftp.exe, msiexec, curl)
  • Run phishing awareness exercises using diplomatic-themed lures for government, energy and engineering staff

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: Not version-specific; abuse of built-in ftp.exe, msiexec, PowerShell, scheduled tasks and VHDX mounting

Timeline of Bitter PapRAT espionage campaign

Last updated · 3 updates · revalidated 3× · latest source

  • Bitter APT active since at least 2013 (year only per Hackread; day/month set to 01-01 as placeholder for the year)
  • Forcepoint X-Labs publishes early BITTER research on custom RATs targeting Pakistani government officials (group active since at least November 2013).
  • Bitter attack on a Chinese government agency reported in prior public research (month-level precision; cited by the Fortinet report).
  • Earliest observation of the locked-ioc-43 sample (SHA256 10cec5a8...970f) later used in the TA397 Turkish defense campaign, per Proofpoint
  • Proofpoint first observes locked-ioc-43 C2 locked-ioc-26 and IP locked-ioc-34 (staging domain locked-ioc-33 first seen 2024-11-07)
  • Proofpoint observed TA397 (Bitter) target a Turkish defense organization with a spearphishing lure (Madagascar infrastructure project theme) and deliver locked-ioc-43 and MiyaRAT
  • Proofpoint publishes 'Hidden in Plain Sight: TA397's New Attack Chain Delivers Espionage RATs' documenting locked-ioc-43 (port 47408, DsSvcCleanup scheduled task, 31+ command handlers)
  • Fortinet FortiGuard Labs primary report published with file hashes, additional C2/staging domains (locked-ioc-25, locked-ioc-27, locked-ioc-30, locked-ioc-22), locked-ioc-42 command set (msg, FDD, DEL, RUN, GDR, SS1, UPP, DWW; Rust adds MS2, SLP, BYE) and Fortinet signatures (LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/locked-ioc-42.A!tr, W32/locked-ioc-43.A!tr).
  • Hackread reports technical details: XOR key 0x50, Rust 11 commands, locked-ioc-29, locked-ioc-32, locked-ioc-39 locked-ioc-43 and C2 domain locked-ioc-28
  • Infosecurity Magazine reports locked-ioc-42 C++ (plaintext HTTP, 8 commands) and Rust (HTTPS) variants and activity in South Asia, Southeast Asia and South Korea
  • FortiGuard Labs (Cara Lin) publishes research attributing the locked-ioc-42 campaign (LNK/locked-ioc-41, MSI-in-VHDX and RAR chains) to Bitter/TA397 with high confidence
  • Cyber Security News reports the FortiGuard BITTER locked-ioc-42/locked-ioc-43 research (VHDX and WebDAV chains) and lists network and file IOCs.

Update history

Sources cited for Bitter PapRAT espionage campaign

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats