Severity: High | Priority: 1
BITTER, a long-running cyber-espionage group also tracked as TA397 and APT-C-08, is running a new campaign against government and official organisations, with activity concentrated in South Asia. The group sends documents styled as official and diplomatic correspondence: requests for bilateral meetings, a letter from an ambassador about a summit, a gala dinner invitation, visa details, and a military staff-programme update. The campaign introduces a new backdoor called PapRAT, written first in C++ and now also in Rust. It is used alongside WmRAT, a backdoor long associated with BITTER.
The attackers use three infection routes, all built on file types that Windows trusts:
The script-based routes collect system information and send it to the attackers. They also fetch new commands from the server at regular intervals, so the attackers can change their behaviour without sending new malware.
Once installed, PapRAT gives the attackers remote control of the computer. They can run commands and PowerShell scripts, browse folders and drives, upload and download files, delete files and take screenshots. In some cases PapRAT installs WmRAT as a second backdoor, so the attackers keep access even if one tool is found.
On any affected computer, isolate it from your network and treat it as compromised. Look for:
Rebuild the computer from a clean image and change the passwords of the user’s accounts. Treat unexpected shortcut files, internet shortcuts, virtual disk images and installer packages with great caution, especially when they arrive as attachments or links in messages styled as official or diplomatic correspondence. Where possible, block VHDX and ISO attachments at the email gateway. Organisations should also block the campaign’s command servers at the firewall.