PapRAT

PapRAT is a custom Windows remote access trojan used by BITTER, also tracked as TA397, in cyberespionage operations targeting South Asian organizations. BITTER has historically targeted government, energy, and engineering organizations. PapRAT provides remote control and surveillance capabilities and has been observed deploying WmRAT as a secondary implant.

PapRAT supports shell command execution, arbitrary program execution, directory and drive enumeration, file deletion, screenshot capture, and file uploads and downloads. Its C++ implementation supports eight commands, receives JSON-formatted instructions over plaintext HTTP, and identifies victims using their username and computer name. It conceals command-and-control configuration with XOR encoding and masquerades as a Microsoft component. A newer Rust implementation expands the command set to eleven by adding PowerShell execution, sleep, and process termination. The Rust version uses HTTPS, obfuscates sensitive constants through string reversal and ROT-3 transformations, and introduces an initial execution delay before periodic command polling.

Observed delivery chains use diplomatic and military-themed meeting letters and event invitations to induce users to open malicious shortcuts. One chain packages a shortcut, decoy spreadsheet, and malicious MSI installer inside a VHDX disk image; another uses an archive containing an internet shortcut to retrieve additional components through WebDAV. MSI custom actions deploy PapRAT while decoy documents or misleading error messages conceal the malicious activity. Associated scripts abuse legitimate Windows utilities and create scheduled tasks to maintain attacker access. These delivery and persistence mechanisms operate alongside PapRAT rather than all being implemented within the trojan itself.