Bitter APT Targets Asia with PapRAT Malware and Living-Off-the-Land Tactics
A suspected South Asian APT group, identified as Bitter, is conducting a cyber-espionage campaign across South and Southeast Asia, employing custom malware and novel techniques to evade detection.
The advanced persistent threat (APT) group Bitter, also known as TA397, has launched a sophisticated cyber-espionage campaign targeting organizations in South and Southeast Asia, as well as South Korea. Researchers at Fortinet's FortiGuard Labs have attributed the campaign with high confidence to Bitter, citing consistent lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis that align with the group's known activities. The campaign's objectives appear to be intelligence gathering, with lure documents referencing diplomatic meetings and international summits, such as the Belt and Road Summit.
This campaign is notable for its use of multiple infection chains, including one that notably eschews traditional malware executables. This "living-off-the-land" approach leverages native Windows tools, such as ftp.exe and curl, to execute malicious scripts and establish persistence through scheduled tasks. This method allows attackers to fetch updated commands directly from their C2 servers without needing to deploy new malware binaries, making detection significantly more challenging for signature-based security solutions.
"When an intrusion leverages trusted system processes, signature-based controls simply have nothing to alert on," commented Shane Barney, CISO at Keeper Security. He emphasized the importance of implementing least-privilege access, restricting native scripting engines, and eliminating standing administrative rights to counter such tactics.
Two other infection chains involve the deployment of PapRAT, a custom remote access trojan (RAT) developed by Bitter. These chains utilize Windows Installer (MSI) packages, with one variant concealed within a decoy spreadsheet inside a virtual hard disk (VHDX) image, and another delivered via a RAR archive containing an internet shortcut. This multi-pronged approach increases the likelihood of successful initial compromise.
PapRAT itself has seen recent evolution, with a new variant written in Rust. While an earlier C++ version posed as a Microsoft component and communicated over plaintext HTTP, the Rust variant has upgraded to HTTPS for C2 communications and added expanded capabilities, including PowerShell execution and process control. Furthermore, in one observed instance, PapRAT was used to download and execute WmRAT, another RAT previously documented by security researchers, further solidifying the link to Bitter's operational infrastructure.
Jason Soroko, a senior fellow at Sectigo, highlighted the difficulty in detecting such campaigns, noting that "a search for PapRAT alone could miss part of the campaign." He warned that removing only the initially discovered implant might not fully eradicate the attacker's presence, underscoring the need for comprehensive threat hunting and incident response.
FortiGuard Labs has provided recommendations for organizations to bolster their defenses, including careful handling of unexpected LNK files, internet shortcuts, disk images, and MSI installers. The research underscores the persistent threat posed by state-sponsored espionage groups and their continuous adaptation of tactics, techniques, and procedures (TTPs) to achieve their objectives while evading detection.
This new report from FortiGuard Labs details the evolution of the PapRAT malware, which has been rewritten from C++ to Rust, expanding its command set from eight to eleven. The updated malware now includes capabilities for PowerShell execution, a sleep directive, and a clean-exit command, indicating continued investment by the BITTER group in their toolset. The research also highlights three distinct infection chains used in the campaign, all leveraging legitimate Windows functionalities like ftp.exe and scheduled tasks to evade detection.