--- id: "CMP-202611-usv6vo" page: "https://infrastack.ai/live/CMP-202611-usv6vo" kind: "campaign" aliases: [] title: "Bitter (TA397) spy group hits South Asian organizations with new PapRAT backdoor via malicious shortcut files, VHDX disk images and MSI installers (Fortinet)" severity: "medium" cvss: null epss: null exploited: true status: "open" category: "other" products: [{"name": "Microsoft Windows", "fixed": [], "vendor": "Microsoft"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-09T15:08:47+00:00" updated_at: "2026-11-09T15:08:49+00:00" sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html", "first_seen_at": "2026-11-09T15:08:47+00:00", "cites": ["https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html"]}] exploit_sources: [] --- # Bitter (TA397) spy group hits South Asian organizations with new PapRAT backdoor via malicious shortcut files, VHDX disk images and MSI installers (Fortinet) Link for people: https://infrastack.ai/live/CMP-202611-usv6vo (this .md is for agents) India-linked espionage group Bitter (APT-C-08, Hazy Tiger, TA397) is targeting organizations in South Asia with a previously unreported Windows remote-access trojan, PapRAT (C++ and Rust versions: remote shell, file upload/download/delete, run files, screenshots, PowerShell). Delivery uses three chains: a .lnk shortcut that abuses ftp.exe to run scripts and set up scheduled tasks; a VHDX disk image whose shortcut opens a decoy Excel sheet while an MSI installs PapRAT; and a .url shortcut that pulls a .lnk over WebDAV leading to an MSI that installs PapRAT, which then drops Bitter's WmRAT. Reported by Fortinet FortiGuard Labs on 9 Nov 2026; start date of the campaign and named victims unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Microsoft Windows affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a person was tricked (social-engineering). The record describes delivery through shortcut, disk image and .url attachments that users must open and the fix recommends blocking attachments from outside senders, but it never states how the attacker got into the victims and says nothing about whether the incident reached customers or dependents. How it reached others: not stated (unknown). So it does not happen to you: Use phishing-resistant second factors on the accounts that matter, and never reset a factor on a phone call alone. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#social-engineering ## How to check Network/DNS traffic to goodnfortunes[.]com, techtalkhelp[.]com or rivingtonclarks[.]com; a file named abc.pdf created then deleted after a curl upload; a downloaded talk.log containing Base64 PowerShell; ftp.exe used to run scripts or create scheduled tasks; .lnk, .url or .vhdx attachments that launch msiexec or fetch files over WebDAV; WmRAT detections. ## Fix Block the three domains; block or warn on .lnk, .url, .vhdx and .msi attachments from outside senders; restrict msiexec and ftp.exe for regular users and alert on new scheduled tasks created by scripts; hunt with Fortinet's indicators and isolate any host that contacted the domains. ## Timeline - 2026-11-09T15:08:47+00:00 analyst https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html ## Documents - [describes] @TheHackersNews: 🚨 Bitter APT is deploying a new backdoor called PapRAT in cyberespionage attacks https://x.com/TheHackersNews/status/2119800258612154773 - [describes] Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html - [discussion] @GreyNoiseIO: GreyNoise Annual Halloween Candy Bracket🍬🍭: 32 candies. 1 winner. 0 ground rules https://x.com/GreyNoiseIO/status/2116244978645209267 - [discussion] @malwrhunterteam: Fortinet's FortiGuard Labs just published an article, titled "BITTER Expands Its https://x.com/malwrhunterteam/status/2117665905081524551 - [discussion] @malwrhunterteam: Fortinet's FortiGuard Labs just published an article, titled "BITTER Expands Its https://x.com/malwrhunterteam/status/2117727640543195466 - [discussion] @martin_casado: I'm a tad biased. But I really think this is the best systems talk on agent harn https://x.com/martin_casado/status/2115866431665647720 - [mentions] Fortinet Threat Research: BITTER Expands Its Arsenal with PapRAT https://feeds.fortinet.com/~/972208619/0/fortinet/blog/threat-research~BITTER-Expands-Its-Arsenal-with-PapRAT - [mentions] Socket: OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole https://socket.dev/blog/opencode-free-usage-bypass?utm_medium=feed --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_