The BITTER cyberespionage group is using Windows tools and custom malware in a campaign targeting South Asian organizations, according to new research from Fortinet.
Researchers at Fortinet's FortiGuard Labs identified three distinct infection chains they attribute with high confidence to BITTER, a suspected South Asian threat group active since at least 2013. According to MITRE ATT&CK, BITTER has previously targeted government agencies and organizations in the energy and engineering sectors, including targets in Pakistan, China, and Bangladesh.
Three Infection Chains Use Different Attack Methods
The first attack chain begins with a malicious Windows shortcut (LNK) file that abuses the built-in ftp.exe utility to execute local commands. A script creates scheduled tasks that use curl to contact an attacker-controlled server and retrieve additional instructions.
Those instructions can be changed on the server without delivering a new malware executable. Fortinet found that one set of server-side instructions collected information about the infected computer and sent it back to the attackers. Another created an additional scheduled task to fetch more commands.
The second chain uses a virtual hard disk (VHDX) file disguised as a letter from an ambassador. When mounted, the disk image exposes a shortcut that, when opened, launches a malicious Windows Installer (MSI) package and displays a decoy spreadsheet.
The spreadsheet gives the victim something seemingly legitimate to view while the installer deploys PapRAT in the background. Once running, the remote access trojan connects to an attacker-controlled server and waits for instructions.
The third chain combines elements of the first two. It starts with an archive containing a malicious URL shortcut that connects to an attacker-controlled server using WebDAV, a protocol for accessing and managing files on remote servers. The shortcut retrieves another Windows shortcut.
As in the first chain, the downloaded shortcut triggers scripts that establish a scheduled task and communicate with the attackers. It also launches an MSI installer that deploys PapRAT.
This time, PapRAT downloads another remote access trojan called WmRAT. The second implant could allow attackers to retain access even if defenders discover and remove PapRAT.
PapRAT Gains Rust Variant and Additional Capabilities
PapRAT gives attackers broad control over an infected computer. It can execute commands, upload and download files, and delete data. It can also gather information about the system, including its directories and connected drives, and capture screenshots.
Fortinet identified C++ and Rust implementations of PapRAT, with the newer Rust variant expanding the command set from eight to eleven. The additional commands allow attackers to execute PowerShell instructions, temporarily suspend communication with the command-and-control server, and terminate the malware process.
The Rust version also communicates with its command server over HTTPS, checking for new instructions every five seconds after an initial 42-second delay. The changes suggest that BITTER is continuing to develop PapRAT rather than relying on a fixed set of capabilities.
BITTER's Tactics Challenge Detection and Incident Response
BITTER's use of legitimate Windows utilities alongside custom malware can make its attacks difficult to detect and fully contain. Security tools focused on known malware files may miss malicious commands that are executed through trusted system processes.
Jason Soroko, senior fellow at Sectigo, said investigators should examine what Windows utilities execute and which servers they contact. They should also check for additional malware and scheduled tasks that could continue retrieving attacker instructions.
“Recovery requires tracing the intrusion beyond the file that triggered the alert and verifying that the attacker’s remaining means of access have been removed,” he said.
To limit attackers' ability to establish persistent access, Shane Barney, chief information security officer at Keeper Security, recommended restricting user privileges and access to scripting tools. He also called for eliminating unnecessary standing administrative rights.
"When administrative permissions and execution pathways are tightly governed, security teams can contain stealthy intrusion attempts before they escalate into persistent operational control," Barney said.
