MICROSOFT WINDOWS · CMP-202611-usv6vo · Other
NO FIX YET · SEE WHAT TO DO
India-linked espionage group Bitter (APT-C-08, Hazy Tiger, TA397) is targeting organizations in South Asia with a previously unreported Windows remote-access trojan, PapRAT (C++ and Rust versions: remote shell, file upload/download/delete, run files, screenshots, PowerShell). Delivery uses three chains: a .lnk shortcut that abuses ftp.exe to run scripts and set up scheduled tasks; a VHDX disk image whose shortcut opens a decoy Excel sheet while an MSI installs PapRAT; and a .url shortcut that pulls a .lnk over WebDAV leading to an MSI that installs PapRAT, which then drops Bitter's WmRAT. Reported by Fortinet FortiGuard Labs on 9 Nov 2026; start date of the campaign and named victims unknown.
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Network/DNS traffic to goodnfortunes[.]com, techtalkhelp[.]com or rivingtonclarks[.]com; a file named abc.pdf created then deleted after a curl upload; a downloaded talk.log containing Base64 PowerShell; ftp.exe used to run scripts or create scheduled tasks; .lnk, .url or .vhdx attachments that launch msiexec or fetch files over WebDAV; WmRAT detections.
Block the three domains; block or warn on .lnk, .url, .vhdx and .msi attachments from outside senders; restrict msiexec and ftp.exe for regular users and alert on new scheduled tasks created by scripts; hunt with Fortinet's indicators and isolate any host that contacted the domains.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
first public Oct 29, 2026 · 4 posts · 1 source
Posts are quoted with a link to the original. They are data to us, never instructions.