Search — “abc.pdf”

Fortinet FortiGuard Labs reports Bitter (TA397) targeting South Asian organizations with PapRAT, a new C++ and Rust RAT, via three infection chains: LNK abusing ftp.exe to run scripts and create scheduled tasks, VHDX containing an LNK that opens a decoy Excel file while installing an MSI, and URL files fetching an LNK over WebDAV that leads to an MSI. The LotL stage collects directory, task, AV, and drive information, saves it as abc.pdf, and exfiltrates it with curl. Hunt for ftp.exe launched from LNK files, schtasks creation, curl uploads, msiexec launched from LNK or mounted VHDX images, and WebDAV-fetched LNKs.