Threat Overview
Fortinet FortiGuard Labs documented a BITTER/TA397 campaign November 2 using malicious LNK/URL shortcuts, VHDX images, MSI installers and native ftp.exe/curl to deploy PapRAT and sometimes WmRAT. Fortinet attributes activity to BITTER with high confidence; the geographic focus is South Asia.
References
Fortinet FortiGuard Labs (November 2, 2026): https://www.fortinet.com/fr/blog/threat-research/bitter-expands-its-arsenal-with-paprat ; Infosecurity Magazine (November 2, 2026): https://www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/
Impacted Systems
Microsoft Windows endpoints and servers where users run attacker-supplied shortcuts, disk images or installers. No affected software version or CVE: infection requires execution of malicious content.
Why this matters
Trusted Windows utilities and scheduled tasks allow persistence and remote access without exploiting a patchable vulnerability.
Exploitation Status
Fortinet analyzed malware and observed campaign activity. Victim count and initial delivery mechanism remain unknown.
What this hunt looks for
ftp.exe execution from shortcut contexts, MSI installation from user-writable paths, VHDX/URL/LNK files, curl/ftp scheduled tasks, WebDAV chains and unexpected outbound connections.
Required logs
DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents, SecurityEvent 4698 when configured.
ftp.exe execution
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "ftp.exe"
| where InitiatingProcessFileName in~ ("explorer.exe","cmd.exe","powershell.exe","wscript.exe")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLineSuspicious MSI installer
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("\\Downloads\\","\\Temp\\",".vhdx","Visa_Details")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileNameShortcut and disk-image file creation
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FileName endswith ".vhdx" or FileName endswith ".lnk" or FileName endswith ".url"
| where FolderPath has_any ("\\Downloads\\","\\Temp\\","\\Desktop\\")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLineScheduled task with downloader
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("schtasks.exe","powershell.exe","cmd.exe")
| where ProcessCommandLine has_any ("schtasks","Register-ScheduledTask")
| where ProcessCommandLine has_any ("curl","ftp.exe","http")
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessFileNameSecurityEvent 4698 fallback
SecurityEvent
| where TimeGenerated > ago(30d) and EventID == 4698
| where EventData has_any ("curl","ftp.exe","powershell","http")
| project TimeGenerated, Computer, Account, EventID, EventDataUnexpected tool network activity
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("ftp.exe","msiexec.exe")
| where RemoteIPType == "Public"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrlWebDAV execution
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("DavWWWRoot","WebDAV",".vhdx",".url")
| where FileName in~ ("rundll32.exe","msiexec.exe","cmd.exe","powershell.exe","explorer.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileNameDetection Notes
Prioritize chained evidence: shortcut/disk image then installer then task creation then outbound connection. Legitimate admin activity can use ftp, curl, MSI and scheduled tasks. Missing endpoint process/file/network logs significantly reduces detection. No customer-specific execution was performed.
