Search — “Bitter”

Fortinet FortiGuard Labs reports Bitter (TA397) targeting South Asian organizations with PapRAT, a new C++ and Rust RAT, via three infection chains: LNK abusing ftp.exe to run scripts and create scheduled tasks, VHDX containing an LNK that opens a decoy Excel file while installing an MSI, and URL files fetching an LNK over WebDAV that leads to an MSI. The LotL stage collects directory, task, AV, and drive information, saves it as abc.pdf, and exfiltrates it with curl. Hunt for ftp.exe launched from LNK files, schtasks creation, curl uploads, msiexec launched from LNK or mounted VHDX images, and WebDAV-fetched LNKs.

The brief item reports that the India-linked Bitter group is running three distinct attack chains that abuse legitimate Windows functionality to target organizations across South Asia, and names PapRAT in its headline. No source could be fetched, so the specific techniques, artifacts, and indicators of these chains are not confirmed here. A hunter should treat the claim as unverified until the original Dark Reading article is reviewed.