{"id":"CMP-202611-usv6vo","kind":"campaign","aliases":[],"related":[],"title":"Bitter (TA397) spy group hits South Asian organizations with new PapRAT backdoor via malicious shortcut files, VHDX disk images and MSI installers (Fortinet)","description":null,"summary":"India-linked espionage group Bitter (APT-C-08, Hazy Tiger, TA397) is targeting organizations in South Asia with a previously unreported Windows remote-access trojan, PapRAT (C++ and Rust versions: remote shell, file upload/download/delete, run files, screenshots, PowerShell). Delivery uses three chains: a .lnk shortcut that abuses ftp.exe to run scripts and set up scheduled tasks; a VHDX disk image whose shortcut opens a decoy Excel sheet while an MSI installs PapRAT; and a .url shortcut that pulls a .lnk over WebDAV leading to an MSI that installs PapRAT, which then drops Bitter's WmRAT. Reported by Fortinet FortiGuard Labs on 9 Nov 2026; start date of the campaign and named victims unknown.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T15:08:47+00:00","products":[{"name":"Microsoft Windows","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Network/DNS traffic to goodnfortunes[.]com, techtalkhelp[.]com or rivingtonclarks[.]com; a file named abc.pdf created then deleted after a curl upload; a downloaded talk.log containing Base64 PowerShell; ftp.exe used to run scripts or create scheduled tasks; .lnk, .url or .vhdx attachments that launch msiexec or fetch files over WebDAV; WmRAT detections.","fix":"Block the three domains; block or warn on .lnk, .url, .vhdx and .msi attachments from outside senders; restrict msiexec and ftp.exe for regular users and alert on new scheduled tasks created by scripts; hunt with Fortinet's indicators and isolate any host that contacted the domains.","status":"open","published_at":null,"first_seen_at":"2026-11-09T15:08:47+00:00","triaged_at":"2026-11-09T15:08:47+00:00","updated_at":"2026-11-09T15:08:49+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-09T15:09:15Z","path":"unknown","entry":"social-engineering","reason":"The record describes delivery through shortcut, disk image and .url attachments that users must open and the fix recommends blocking attachments from outside senders, but it never states how the attacker got into the victims and says nothing about whether the incident reached customers or dependents.","confidence":0.55}},"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '08':42B '2026':139B '9':137B 'abus':82B 'access':59B 'apt':40B 'apt-c':39B 'asia':51B 'asian':7A 'backdoor':12A 'bitter':1A,38B,128B 'c':41B,62B 'campaign':29B,144B 'chain':77B 'cmp':24A 'date':141B 'decoy':100B 'deliveri':74B 'disk':18A,94B 'drop':127B 'earli':31B 'early-warn':30B 'espionag':36B 'excel':101B 'file':16A,68B,71B 'fortiguard':134B 'fortinet':23A,133B 'ftp.exe':83B 'group':4A,37B 'hazi':43B 'hit':5A 'imag':19A,95B 'india':34B 'india-link':33B 'instal':22A,106B,123B 'lab':135B 'lead':118B 'link':35B 'lnk':79B,115B 'malici':14A 'microsoft':27A 'msi':21A,105B,121B 'name':146B 'new':10A 'nov':138B 'open':98B 'organ':8A,48B 'paprat':11A,61B,107B,124B 'powershel':73B 'previous':54B 'pull':113B 'remot':58B,66B 'remote-access':57B 'report':131B 'run':70B,85B 'rust':64B 'schedul':90B 'screenshot':72B 'script':86B 'set':88B 'sheet':102B 'shell':67B 'shortcut':15A,80B,97B,111B 'south':6A,50B 'spi':3A 'start':140B 'ta397':2A,45B 'target':47B 'task':91B 'three':76B 'tiger':44B 'trojan':60B 'unknown':148B 'unreport':55B 'upload/download/delete':69B 'url':110B 'use':75B 'usv6vo':26A 'version':65B 'vhdx':17A,93B 'via':13A 'victim':147B 'warn':32B 'webdav':117B 'whose':96B 'window':56B 'windows':28A 'wmrat':130B","nicknames":["Bitter","TA397","Hazy Tiger","APT-C-08","APT-Q-37","Orange Yali","T-APT-17","PapRAT","WmRAT"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["aptc08","aptq37","bitter","hazytiger","microsoftwindows","orangeyali","paprat","ta397","tapt17","windows","wmrat"],"ptokens":["microsoft","windows"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"malware","search_a":"'-202611':25A 'asian':7A 'backdoor':12A 'bitter':1A 'cmp':24A 'disk':18A 'file':16A 'fortinet':23A 'group':4A 'hit':5A 'imag':19A 'instal':22A 'malici':14A 'microsoft':27A 'msi':21A 'new':10A 'organ':8A 'paprat':11A 'shortcut':15A 'south':6A 'spi':3A 'ta397':2A 'usv6vo':26A 'vhdx':17A 'via':13A 'windows':28A","search_b":"'08':42B '2026':139B '9':137B 'abus':82B 'access':59B 'apt':40B 'apt-c':39B 'asia':51B 'bitter':38B,128B 'c':41B,62B 'campaign':29B,144B 'chain':77B 'date':141B 'decoy':100B 'deliveri':74B 'disk':94B 'drop':127B 'earli':31B 'early-warn':30B 'espionag':36B 'excel':101B 'file':68B,71B 'fortiguard':134B 'fortinet':133B 'ftp.exe':83B 'group':37B 'hazi':43B 'imag':95B 'india':34B 'india-link':33B 'instal':106B,123B 'lab':135B 'lead':118B 'link':35B 'lnk':79B,115B 'msi':105B,121B 'name':146B 'nov':138B 'open':98B 'organ':48B 'paprat':61B,107B,124B 'powershel':73B 'previous':54B 'pull':113B 'remot':58B,66B 'remote-access':57B 'report':131B 'run':70B,85B 'rust':64B 'schedul':90B 'screenshot':72B 'script':86B 'set':88B 'sheet':102B 'shell':67B 'shortcut':80B,97B,111B 'south':50B 'start':140B 'ta397':45B 'target':47B 'task':91B 'three':76B 'tiger':44B 'trojan':60B 'unknown':148B 'unreport':55B 'upload/download/delete':69B 'url':110B 'use':75B 'version':65B 'vhdx':93B 'victim':147B 'warn':32B 'webdav':117B 'whose':96B 'window':56B 'wmrat':130B","search_c":"","cause_entry":"social-engineering","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-10-29T16:20:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-usv6vo","url":"https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T15:08:47+00:00","fetched_at":"2026-11-09T15:08:47+00:00","note":null,"cites":["https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html"]}],"documents":[{"id":107859,"url":"https://x.com/TheHackersNews/status/2119800258612154773","title":"@TheHackersNews: 🚨 Bitter APT is deploying a new backdoor called PapRAT in cyberespionage attacks","kind":"post","source":"x","publisher":null,"text":"🚨 Bitter APT is deploying a new backdoor called PapRAT in cyberespionage attacks targeting South Asian organizations.\n\nThe campaign uses 3 infection chains, including malicious shortcuts and MSI installers, to deliver malware capable of remote commands, file transfers, and https://t.co/av9y4RDufG\n\nlikes 15 reposts 3","published_at":"2026-11-09T14:32:20+00:00","relation":"describes","confidence":null,"note":null},{"id":107992,"url":"https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html","title":"Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia","kind":"blog","source":"analyst","publisher":null,"text":"Fortinet FortiGuard Labs (Cara Lin): Bitter (APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, TA397) targets South Asian organizations with new RAT PapRAT (C++ and Rust variants). Three infection chains: (1) LNK abusing ftp.exe to run scripts and create scheduled tasks contacting C2; (2) VHDX disk image with LNK opening a lure Excel spreadsheet while an MSI installer deploys PapRAT; (3) URL shortcut fetching LNK via WebDAV, leading to MSI that deploys PapRAT, which drops WmRAT. Recon commands from goodnfortunes[.]com, results saved as abc.pdf and exfiltrated via curl. Second script version fetches talk.log from techtalkhelp[.]com (Base64 PowerShell). PapRAT C2 for uploads: rivingtonclarks[.]com. Commands MSG, FDD, DEL, RUN, GDR, SS1, UPP, DWW; Rust adds MS2 (PowerShell), SLP, BYE.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":18461,"url":"https://socket.dev/blog/opencode-free-usage-bypass?utm_medium=feed","title":"Socket: OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole","kind":"blog","source":"blog","publisher":null,"text":"OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole\n\nAn OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.","published_at":"2026-10-29T16:20:11+00:00","relation":"mentions","confidence":null,"note":null},{"id":18421,"url":"https://x.com/martin_casado/status/2115866431665647720","title":"@martin_casado: I'm a tad biased. But I really think this is the best systems talk on agent harn","kind":"post","source":"x","publisher":null,"text":"I'm a tad biased. But I really think this is the best systems talk on agent harnesses. And what it means to be self improving and bitter lesson aligned. IMO a must watch:\n\nhttps://t.co/NcUOA6LlJi\n\nlikes 205 reposts 13","published_at":"2026-10-29T18:00:42+00:00","relation":"discussion","confidence":null,"note":"@martin_casado"},{"id":25364,"url":"https://x.com/GreyNoiseIO/status/2116244978645209267","title":"@GreyNoiseIO: GreyNoise Annual Halloween Candy Bracket🍬🍭: 32 candies. 1 winner. 0 ground rules","kind":"post","source":"x","publisher":null,"text":"GreyNoise Annual Halloween Candy Bracket🍬🍭: 32 candies. 1 winner. 0 ground rules.\n\nAfter much debate, several bitter Skittles fans, and one unconfirmed claim of bracket tampering, Reese’s Peanut Butter Cups took the 2026 crown. 👑🎉\n\nSome of the best comments from the voting: https://t.co/Smxw7RSliv\n\nlikes 20 reposts 3","published_at":"2026-10-30T19:04:55+00:00","relation":"discussion","confidence":null,"note":"@GreyNoiseIO"},{"id":59934,"url":"https://x.com/malwrhunterteam/status/2117665905081524551","title":"@malwrhunterteam: Fortinet's FortiGuard Labs just published an article, titled \"BITTER Expands Its","kind":"post","source":"x","publisher":null,"text":"Fortinet's FortiGuard Labs just published an article, titled \"BITTER Expands Its Arsenal with PapRAT\": https://t.co/TMI0dHcOI3\nLooking at the IoCs, seems I looked at some related samples already in like September but for some reason nothing got tweeted. But at least found Smelly https://t.co/QSPlw9VQFD https://t.co/rL9kS93BPc\n\nlikes 2 reposts 2","published_at":"2026-11-03T17:11:10+00:00","relation":"discussion","confidence":null,"note":"@malwrhunterteam"},{"id":60220,"url":"https://feeds.fortinet.com/~/972208619/0/fortinet/blog/threat-research~BITTER-Expands-Its-Arsenal-with-PapRAT","title":"Fortinet Threat Research: BITTER Expands Its Arsenal with PapRAT","kind":"blog","source":"blog","publisher":null,"text":"BITTER Expands Its Arsenal with PapRAT\n\nFortiGuard Labs examines a BITTER cyberespionage campaign targeting South Asian organizations through three attack chains and the PapRAT remote access trojan","published_at":"2026-11-02T14:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":60712,"url":"https://x.com/malwrhunterteam/status/2117727640543195466","title":"@malwrhunterteam: Fortinet's FortiGuard Labs just published an article, titled \"BITTER Expands Its","kind":"post","source":"x","publisher":null,"text":"Fortinet's FortiGuard Labs just published an article, titled \"BITTER Expands Its Arsenal with PapRAT\": https://t.co/UBmCiVmHii\nIn a previous tweet I wrote \"seems I looked at some related samples already in like September but for some reason nothing got tweeted\" - that was wrong. https://t.co/EKV5SYiuIW https://t.co/OuUJvJBg0a\n\nlikes 8 reposts 1","published_at":"2026-11-03T21:16:29+00:00","relation":"discussion","confidence":null,"note":"@malwrhunterteam"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}