PapRAT malware is a newly documented remote access trojan used in a cyberespionage campaign attributed to the Bitter threat group. Security researchers have identified multiple infection methods targeting organizations in South Asia, combining deceptive documents, legitimate Windows utilities, and attacker-controlled command-and-control infrastructure. The campaign highlights the importance of domain threat intelligence and phishing infrastructure monitoring alongside endpoint detection and incident response.

For CISOs, SOC analysts, and threat intelligence teams, the operation illustrates how attackers can hide malicious activity behind ordinary system processes while maintaining communication with external servers.

Understanding these techniques helps organizations identify suspicious infrastructure, investigate potential compromises, and strengthen their defenses against targeted cyberespionage.

What Is PapRAT Malware?

PapRAT malware is a remote access trojan (RAT) associated with the Bitter advanced persistent threat group, also tracked as TA397.

Fortinet’s FortiGuard Labs disclosed the campaign on November 2, 2026, after investigating attacks against South Asian organizations.

The researchers attributed the activity to Bitter with high confidence based on malware characteristics, infrastructure, file metadata, and attack patterns.

PapRAT allows attackers to remotely interact with compromised Windows systems.

Its documented capabilities include:

• Executing commands on infected computers.
• Uploading and downloading files.
• Deleting files and enumerating directories.
• Capturing screenshots.
• Identifying connected storage drives.
• Communicating with attacker-controlled servers.
• Executing additional PowerShell commands in newer variants.

Researchers identified both C++ and Rust implementations.

The Rust version adds functionality for PowerShell execution, delayed communication, and controlled termination.

The malware’s development suggests continued investment in customized cyberespionage capabilities rather than dependence on commercially available remote administration tools.

How Bitter Hackers Deploy PapRAT Malware

The campaign uses three separate infection chains, each designed to persuade victims to interact with apparently legitimate files.

The delivery mechanisms differ, but their objective is similar: establish unauthorized access while reducing the likelihood of immediate detection.

1. Malicious Windows shortcut files

The first infection chain begins with a Windows shortcut file, commonly known by its .lnk extension.

Researchers observed filenames referencing military training programs and bilateral meetings.

When opened, the shortcut abuses the legitimate Windows ftp.exe utility to execute commands embedded in associated files.

The attack subsequently creates scheduled tasks that maintain communication with remote infrastructure.

This technique is known as living off the land, where attackers misuse legitimate operating system tools instead of relying entirely on recognizable malware executables.

2. Virtual disk images containing hidden installers

The second infection chain uses a VHDX virtual disk image disguised as a diplomatic communication.

When mounted, the image presents a shortcut that opens a decoy spreadsheet while silently launching a Windows Installer package.

The installer deploys PapRAT in the background.

Because the visible spreadsheet appears to open normally, the victim may remain unaware that malicious software has executed.

3. URL shortcuts and WebDAV infrastructure

The third infection chain introduces a URL shortcut inside a compressed archive.

The shortcut connects to an external WebDAV location and retrieves additional malicious components.

WebDAV is a legitimate protocol for accessing and managing remote files, but attackers can abuse it to deliver executable content.

This chain ultimately installs PapRAT and can introduce WmRAT, another remote access trojan previously associated with Bitter.

Why Command-and-Control Domains Matter in This Campaign

Command-and-control (C2) infrastructure enables attackers to communicate with compromised systems, deliver instructions, and retrieve information.

In the PapRAT campaign, domains played an important role in sustaining malicious operations.

FortiGuard Labs identified several domains associated with the attack infrastructure, including:

• goodnfortunes[.]com
• techtalkhelp[.]com
• rivingtonclarks[.]com
• rappellingaart[.]com
• chestergreenfarming[.]com

These defanged indicators are included for defensive investigation and should not be treated as ordinary browsing destinations.

The domains served different operational purposes, including command delivery, malware staging, and remote communication.

For example, researchers observed infrastructure delivering scripts that could be modified remotely without requiring attackers to distribute a new executable.

This flexibility allows malicious operations to evolve while retaining access to infected computers.

However, not every suspicious domain is necessarily a phishing website or an impersonation attempt.

The PapRAT investigation documents malicious infrastructure, but it does not establish that Bitter systematically used typosquatting or fake corporate domains in this campaign.

That distinction is essential when evaluating domain-based threats.

How Domain Threat Intelligence Supports PapRAT Investigations

Domain intelligence provides valuable context during cyberespionage investigations.

Rather than examining a suspicious hostname in isolation, analysts can investigate its registration characteristics, DNS configuration, hosting relationships, certificate history, and associated activity.

Investigating suspicious infrastructure

Security teams can use domain monitoring and investigation technology to evaluate external infrastructure and identify potentially malicious websites.

SpoofGuard provides capabilities involving DNS analysis, WHOIS information, certificate monitoring, infrastructure indicators, and website-content assessment.

These capabilities are particularly relevant when an investigation involves suspected domain impersonation, phishing infrastructure, or suspicious domain activity.

However, the existence of a C2 domain in a malware investigation does not establish that a brand-monitoring platform would automatically identify the malware itself.

Endpoint security and network detection remain necessary.

Correlating domain relationships

Domain investigations become more useful when analysts connect multiple observations.

Relevant indicators include:

• Domain registration dates and changes.
• Historical DNS records.
• Hosting providers and IP relationships.
• Certificate Transparency records.
• Unexpected website redirects.
• Known malicious infrastructure associations.
• Changes in website content or server behavior.

Correlating these signals can help analysts prioritize investigations and identify potentially related infrastructure.

A suspicious registration or unusual hosting arrangement alone does not prove malicious intent.

Distinguishing phishing from malware delivery

The PapRAT campaign also illustrates why defenders should distinguish between several types of external threats.

A phishing domain typically attempts to deceive users into revealing information or interacting with fraudulent content.

A malware staging domain may primarily deliver executable components.

A command-and-control domain enables communications with compromised endpoints.

These functions can overlap, but they are not interchangeable.

SpoofGuard examines a related issue in its article on spoofing detection and WebDAV malware abuse, explaining how legitimate web technologies can support deceptive malware campaigns.

Why PapRAT Is Difficult to Detect

The campaign combines familiar Windows functionality with customized malware.

This creates challenges for organizations relying mainly on known malware signatures.

Abuse of legitimate system utilities

The attackers use legitimate utilities such as ftp.exe, curl, and Windows Task Scheduler.

Because these tools are commonly available in enterprise environments, their presence alone is not suspicious.

Security teams must examine how they are used, which processes launch them, and what external infrastructure they contact.

Deceptive filenames and documents

The campaign includes diplomatic-themed documents and apparently legitimate spreadsheets.

These lures exploit the recipient’s expectations and professional responsibilities.

Targeted users may be more willing to open a document that appears relevant to a current meeting or official communication.

Practical security awareness training can help employees recognize suspicious attachments, unusual download instructions, and misleading document formats.

Training should complement technical controls that restrict unsafe execution.

Multiple malware implementations

PapRAT’s C++ and Rust versions provide overlapping capabilities but use different implementation techniques.

The Rust variant introduces additional commands and HTTPS-based communications.

This development complicates detection strategies that rely on a single file signature or narrowly defined network pattern.

Behavioral monitoring is therefore particularly important.

How Organizations Can Defend Against PapRAT Attacks

Organizations should adopt layered defenses addressing both the initial infection and subsequent attacker activity.

Strengthen email and attachment security

Inspect unsolicited archives, shortcut files, virtual disk images, and installer packages.

Restrict execution of suspicious file types where operationally appropriate.

Employees should verify unexpected diplomatic, administrative, or business documents through established communication channels.

Monitor unusual Windows activity

Security teams should investigate suspicious execution chains involving:

• Shortcut files launching command interpreters.
• Unexpected use of ftp.exe or curl.
• Newly created scheduled tasks.
• Silent MSI installations.
• Unusual PowerShell activity.
• Processes contacting unfamiliar external servers.

Endpoint detection and response systems can provide valuable behavioral evidence.

Investigate external network connections

SOC analysts should review network telemetry for known indicators associated with the campaign.

The original FortiGuard Labs PapRAT investigation includes documented infrastructure indicators and malware hashes that can support defensive hunting.

Indicators should be validated against current threat intelligence because malicious infrastructure can change over time.

Prepare incident-response procedures

If PapRAT infection is suspected, organizations should isolate affected systems, preserve forensic evidence, and investigate persistence mechanisms.

Review scheduled tasks, suspicious processes, external communications, and potentially accessed files.

Rebuild compromised systems when necessary and assess whether exposed credentials require rotation.

Frequently Asked Questions

What is PapRAT malware used for?

PapRAT is a remote access trojan used for cyberespionage.

It allows attackers to execute commands, inspect files, capture screenshots, transfer information, and maintain communication with compromised Windows systems.

Its capabilities make it suitable for reconnaissance, information collection, and persistent unauthorized access.

Who is behind the PapRAT campaign?

FortiGuard Labs attributes the campaign to Bitter, also known as TA397, with high confidence.

The attribution is based on technical evidence, including malware characteristics, file metadata, infrastructure, and attack patterns.

This assessment identifies the suspected threat group but does not independently establish the identity of every individual involved.

Can domain monitoring detect PapRAT attacks?

Domain monitoring can provide useful information about suspicious infrastructure and potentially related malicious websites.

However, it cannot independently confirm that PapRAT is installed on a device.

Organizations should combine domain intelligence with endpoint detection, network monitoring, and incident-response capabilities.

What makes PapRAT different from ordinary malware?

PapRAT is associated with targeted cyberespionage rather than broad, indiscriminate malware distribution.

Its delivery mechanisms combine deceptive documents, legitimate Windows utilities, scheduled tasks, and custom remote access functionality.

The availability of C++ and Rust implementations also demonstrates continued development of the malware family.

Strengthen Visibility Into Suspicious Domains and External Threats

The PapRAT campaign demonstrates how attackers combine deceptive files, legitimate system utilities, and external infrastructure to maintain unauthorized access.

While endpoint protection remains essential, organizations also benefit from greater visibility into suspicious domains, phishing infrastructure, and potential brand impersonation.

SpoofGuard helps security teams monitor domain activity, investigate suspicious websites, and assess external threats using contextual evidence.

Explore the platform through a 7-day SpoofGuard free trial to strengthen domain monitoring, improve investigation workflows, and identify potential brand abuse before it escalates.