It Arrives as a Shortcut. It Stays as a Backdoor.

Nothing in this attack looks like an attack. A shortcut file. A disk image that opens a spreadsheet. An installer doing what installers do. But researchers at Fortinet’s FortiGuard Labs say the espionage group known as Bitter is using exactly those unremarkable objects to plant a brand-new backdoor, PapRAT, inside South Asian organizations.

Bitter — tracked under a stack of aliases including APT-C-08, TA397, Hazy Tiger, and Orange Yali — has spied on governments and organizations across South Asia for years. PapRAT, short for the group’s latest remote access trojan, is its newest tool, and it arrives through three different doors at once.

Three chains, one backdoor

The first chain starts with a Windows shortcut (LNK) file. Instead of dropping an obvious payload, it abuses ftp.exe — a file-transfer utility built into Windows — to run scripts and create scheduled tasks that keep the infected machine in contact with a command server at goodnfortunes[.]com.

The second chain hides inside a VHDX virtual disk image. Its shortcut opens a lure Excel spreadsheet for the victim to read, while an MSI installer quietly deploys PapRAT in the background. The third chain combines the tricks: a URL shortcut pulls a shortcut file over WebDAV, which fetches an MSI installer via curl — which installs PapRAT and also drops WmRAT, an older Bitter tool.

Built to be reprogrammed from the server

PapRAT exists in two implementations, C++ and Rust. Fortinet researcher Cara Lin catalogs eight commands in the main build: a remote shell, directory listing, file deletion, arbitrary file execution, drive enumeration, screenshot capture, and upload/download to and from the command server. The Rust variant adds PowerShell execution, a sleep-and-resume command, and a self-termination command.

The smarter design choice is what PapRAT does before the trojan even lands. The early scripts harvest reconnaissance — directory listings from Desktop, Documents, and Downloads, installed antivirus products, mounted drives — save it disguised as “abc.pdf,” send it home with curl, and delete the file. A second script retrieves a file called “talk.log” from techtalkhelp[.]com containing Base64-encoded PowerShell instructions. Because the instructions are updated on the server, the attackers can change the operation without pushing a new binary — no fresh executable drops, no process injection for security tools to catch.

It is the same patience that made the cwpdoor backdoor so hard to spot inside a server control panel: live inside tools the system already trusts, and the malicious part is just behavior, not a file.

One detail shows how the operators think. In one part of the operation, a script downloads a file called talk.log that contains instructions encoded in Base64, which the machine then runs through PowerShell. Nothing about that requires a new malicious binary: the orders live on the server and can change at any time, while the implant on the victim’s machine stays small, quiet, and generic. For defenders, that flips the usual hunt — the most telling evidence is not a suspicious file but a trusted tool doing something it has no business doing, at an hour nobody scheduled.

What defenders should watch

Fortinet’s guidance is pointed: monitor behavior across scripting tools, scheduled tasks, and installer activity — not just known malware signatures. Concretely:

Treat unexpected files as guilty. Shortcut files, URL shortcuts, disk images, and MSI packages arriving through unsolicited messages are this campaign’s entire delivery system. Caution there stops all three chains at the door.

Watch the built-ins. ftp.exe, curl, and PowerShell making outbound connections — especially to unfamiliar domains — are the loudest signals this tradecraft produces. The tools are legitimate; the behavior is not.

Hunt new scheduled tasks. Persistence here runs through tasks users never created. Inventory them, and alert on new ones that launch scripts or system utilities.

Assume exposure means compromise. If a PapRAT chain ran to completion, follow the same rule applied to the QNAP Plex2Shell breaches: treat the device as compromised, hunt for the second implant (WmRAT rides along), and rebuild trust deliberately rather than cleaning and hoping.

Bitter keeps refining a custom arsenal built for one purpose: quiet, durable access. PapRAT’s lesson is that durability no longer needs exotic exploits — just the files and tools already sitting on every Windows machine.