# Bitter (TA397) Deploys PapRAT (C++ and Rust) via LNK, MSI/VHDX and RAR Chains Against South Asian Organizations

> FortiGuard Labs attributes with high confidence a cyber-espionage campaign to Bitter (TA397) that delivers a custom RAT, PapRAT, in C++ and Rust variants. Three delivery chains use diplomatic-themed lures: an LNK abusing ftp.exe, MSI packages inside a VHDX image, and a RAR with an internet shortcut that also fetches WmRAT. No software vulnerability is exploited.

- **Published:** 2026-11-02T14:29:17Z
- **Last reviewed:** 2026-11-03T06:56:58.219Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5059
- **ID:** TL-2026-5059
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** HAZY TIGER (India)
- **Detections:** 9 (1 shown free below) · **IOCs:** 44 (3 shown free below)

## Description

FortiGuard Labs (researcher Cara Lin), as reported by Infosecurity Magazine and Hackread on 2026-11-02, describes a Bitter (TA397) espionage campaign against South Asian organizations (government, energy and engineering per Hackread), with additional telemetry in Southeast Asia and South Korea. Attribution to Bitter is high confidence, based on lure filenames, C2 patterns, file metadata and malware analysis. Bitter is described as a suspected South Asian group active since at least 2013. No CVE is exploited; all chains rely on user execution of diplomatic- and military-themed lures (bilateral meeting requests, an ambassador's letter referencing the 11th Belt and Road Summit, a 2026 gala dinner invitation).

Three delivery chains were identified. Chain 1 is a living-off-the-land chain: a malicious LNK abuses the built-in ftp.exe to launch scripts disguised as icon files, uses PowerShell, curl and scheduled tasks for persistence, collects system and antivirus information and sends it to the C2 in a file named abc.pdf, and shows a fake Windows error message as distraction. No traditional malware executable is deployed. Chain 2 uses a VHDX image (Letter from the Ambassador - 11th Belt and Road Summit.vhdx) containing a shortcut that opens a decoy spreadsheet while launching the MSI Visa_Details.msi in the background, installing PapRAT disguised as Microsoft software. Chain 3 uses a RAR archive containing an internet (URL) shortcut that retrieves an LNK over WebDAV, which launches Imp_Details.msi to deploy PapRAT; PapRAT then downloads a second implant, WmRAT, disguised as vnces.exe. WmRAT is a C++ RAT previously documented as a Bitter indicator and uses the C2 domain netmansrvdns.com.

PapRAT is a custom RAT with C++ and Rust variants. The C++ variant masquerades as a Microsoft component, XOR-encodes its C2 configuration with key 0x50, beacons over plaintext HTTP and supports eight commands including remote command execution, file operations/transfers, directory and drive listing, and screenshot capture. The Rust variant switches to HTTPS, conceals C2 strings with string reversal and ROT-3 shifts, and expands the command set to 11 by adding PowerShell execution, sleep/pause and clean exit; it waits 42 seconds before starting and checks in every 5 seconds. Build artifacts include product name 'papsolutions' and PDB file name requpap.pdb.

Sourcing caveats: the original FortiGuard report and the assigned Dark Reading article could not be retrieved, so this record relies on two secondary mirrors. Neither lists file hashes or C2 IP addresses. The BeaconBeagle lookup for netmansrvdns.com returned HTTP 502, so no C2 correlation is recorded. Sources differ slightly on the Rust command count details (Infosecurity: three added commands; Hackread: 8 to 11).

## MITRE ATT&CK

- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1218.007 Msiexec
- T1202 Indirect Command Execution
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1059 Command and Scripting Interpreter
- T1140 Deobfuscate/Decode Files or Information
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1059.003 Command and Scripting Interpreter
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1566.001 Phishing
- T1033 System Owner/User Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Bitter PapRAT Chain 1 - ftp.exe Script Execution via LNK (TL-2026-5059)** (`TL-2026-5059-SPL-001`)

Detects the living-off-the-land stage of the Bitter (TA397) PapRAT campaign where a malicious LNK abuses the built-in ftp.exe with the -s: switch to run a command script that is disguised as an icon or image file. ftp.exe is almost never run with -s: scripts on modern endpoints, so this behaviour is a strong indicator of Indirect Command Execution (T1202) following user execution of a diplomatic-themed lure (T1204.002). Flags disguised script extensions and shell or explorer parents to help triage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1202, T1204.002, T1059, T1036.005
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (OriginalFileName="ftp.exe" OR Image="*ftp.exe")
| where match(CommandLine, "(?i)[[:space:]][-/]s:[^[:space:]]+")
| eval disguised_script=if(match(CommandLine, "(?i)[.](ico|png|jpg|jpeg|bmp|gif|txt|dat)"),1,0)
| eval lnk_launcher_parent=if(match(ParentImage, "(?i)(explorer|cmd|powershell|wscript|cscript)[.]exe$"),1,0)
| table _time host User ParentImage ParentCommandLine Image CommandLine disguised_script lnk_launcher_parent
| sort 0 - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "ftp.exe" or ProcessVersionInfoOriginalFileName =~ "ftp.exe"
| where ProcessCommandLine matches regex @"(?i)\s[-/]s:\S+"
| extend DisguisedScript = ProcessCommandLine matches regex @"(?i)\.(ico|png|jpg|jpeg|bmp|gif|txt|dat)\b"
| extend LnkLauncherParent = InitiatingProcessFileName in~ ("explorer.exe", "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DisguisedScript, LnkLauncherParent, SHA256
```

### Sigma

```yaml
title: Bitter PapRAT ftp.exe Script Execution via LNK
id: 3f6a1c92-8b47-4d15-a6e3-2c9d7b05e1a8
status: experimental
description: Detects ftp.exe launched with the -s switch to execute a script file, as used by the Bitter (TA397) PapRAT LNK chain where the script is disguised as an icon file.
references:
  - https://www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/
  - https://hackread.com/bitter-apt-fake-diplomatic-documents-paprat-spyware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
  - attack.defense-evasion
  - attack.t1202
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\ftp.exe'
    - OriginalFileName: 'ftp.exe'
  selection_script:
    CommandLine|contains:
      - ' -s:'
      - ' /s:'
  condition: all of selection_*
falsepositives:
  - Legacy automation or administrators using scripted ftp.exe transfers
level: high
```

**Known false positives:**

- Legacy batch jobs or admin scripts that automate ftp.exe uploads with -s: script files
- Software deployment tooling that scripts ftp.exe from a known service account

**Tuning notes:** Allow-list known service accounts and approved script paths used for scripted FTP. Raise priority when disguised_script=1 or the parent is explorer.exe (LNK double-click). Requires Sysmon EventCode 1 with OriginalFileName populated (Sysmon 10+); the Image wildcard covers older versions.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Bitter PapRAT MSI Installer Launch ([indicator] / [indicator]) (locked: unlock with TL Creds)
- Bitter PapRAT Chain 1 System and AV Discovery with [indicator] Exfiltration (locked: unlock with TL Creds)
- Bitter PapRAT Beaconing - High-Frequency Check-ins from Non-Browser Process (locked: unlock with TL Creds)
- Bitter PapRAT Chain 3 - WebDAV-Delivered LNK Launch from Archive Internet Shortcut (locked: unlock with TL Creds)
- Bitter PapRAT Implant Artifacts - papsolutions Product Name and [indicator] WmRAT (locked: unlock with TL Creds)
- Bitter WmRAT C2 Network Activity - Port 47408 and [indicator] Connections (locked: unlock with TL Creds)
- Bitter PapRAT Scheduled Task Persistence via Script and LOLBin Parents (locked: unlock with TL Creds)
- Bitter WmRAT C2 Domain and IP Contact ([indicator] and Related Infrastructure) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 44)

Defanged, TLP:CLEAR.

- IP address: `38.180.142[.]228`
- Domain: `netmansrvdns[.]com`
- File hash: `10cec5a84943f9b0c635640fad93fd2a2469cc46aae5e43a4604c903d139970f`

Full set of 44 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign](https://www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/)
- [BITTER APT Using Fake Diplomatic Documents to Deliver PapRAT Spyware](https://hackread.com/bitter-apt-fake-diplomatic-documents-paprat-spyware/)
- [Hidden in Plain Sight: TA397's New Attack Chain Delivers Espionage RATs (Proofpoint)](https://proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats)
- [Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware](https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html)
- [Rewterz: Bitter APT uses WmRAT and MiyaRAT to target Turkish defense sector - Active IOCs](https://rewterz.com/threat-advisory/bitter-apt-uses-wmrat-and-miyarat-to-target-turkish-defense-sector-active-iocs)
- [Antiy: Continued Phishing Attempts Against Endpoint Targets - Recent Sample Analysis of the BITTER Attack Group](https://www.antiy.net/p/continued-phishing-attempts-against-endpoint-targets/)
- [QiAnxin: The Shadow Lives - Analysis of Recent Attack Activities of the Bitter Group](https://ti.qianxin.com/blog/articles/the-shadow-lives-analysis-of-recent-attack-activities-of-the-bitter-group-en/)
- [Sophisticated TA397 Malware Targets Turkish Defense Sector](https://www.infosecurity-magazine.com/news/ta397-malware-targets-turkish/)
- [The Bitter end: unravelling 8 years of APT antics (Virus Bulletin 2025 slides)](https://www.virusbulletin.com/uploads/pdf/conference/vb2025/slides/Slides-The-Bitter-end-unravelling-8-years-of-APT-antics.pdf)
- [MalwareBazaar: APT_IN_TA397_wmRAT YARA hits](https://bazaar.abuse.ch/browse/yara/APT_IN_TA397_wmRAT)
- [APT PROFILE - TA397 (CYFIRMA)](https://www.cyfirma.com/?p=37485)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5059