Hackers Deliver PapRAT to Windows Devices via Malicious VHDX Files and WebDAV Links

A suspected espionage group is sending forged meeting letters and event invitations to organizations across South Asia. The attached files appear benign but quietly install a custom remote access trojan called PapRAT on Windows systems.

The campaign employs Windows virtual disk images, shortcut files, and remote web folders to evade easy detection. Security researchers attribute the activity to BITTER, a group believed to operate from South Asia and active since at least 2013.

BITTER has previously targeted government, energy, and engineering organizations. The discovery of PapRAT is consistent with the group’s continued development and investment in bespoke malware tools.

Researchers at Fortinet’s FortiGuard Labs tracked the campaign for several months and linked the operations to BITTER with high confidence based on lure filenames, command-and-control traffic patterns, file metadata, and malware analysis. They identified three distinct infection chains; two of them use VHDX files and WebDAV-hosted content.

Malicious VHDX Files and WebDAV Links

One infection chain begins with a VHDX file, a Windows virtual hard disk image that mounts like a removable drive. In one example the image was named “Letter from the Ambassador – 11th Belt and Road Summit.” When mounted it displays a single visible LNK shortcut file and two hidden files: a decoy spreadsheet titled “Attachment-2.xls” and an installer named “Visa_Details.msi.”

If the victim clicks the shortcut, a command runs that launches the installer silently while simultaneously opening the spreadsheet. The user sees the legitimate-looking document and has no reason to suspect anything malicious. This technique—using VHDX files to present decoys while executing hidden payloads—has been observed in other campaigns as well, such as APT-C-60 targeting recruiters in Japan.

The third infection chain leverages WebDAV, a Windows feature that exposes files on a remote web server as if they were local. This chain starts with an archive named “Official Invitation Majilis 2026 Gala Dinner.rar.” Inside is a URL shortcut that connects to a remote server and downloads a shortcut and a script. The script creates a scheduled task, contacts the attacker-controlled server, and installs a second MSI named “Imp_Details.msi.”

Attackers favor WebDAV because a remote folder appears as an ordinary local folder to the user. Researchers have noted that WebDAV access can bypass typical browser warnings, making abuse of Windows File Explorer an increasingly common delivery mechanism for remote access trojans.

The first infection chain is subtler: a shortcut abuses the built-in Windows ftp.exe to run a hidden script, then configures scheduled tasks with names like “MicrosoftUpdates” and uses curl to contact the attacker’s server. A fake pop-up notifies the user that Explorer could not open the file. Because no traditional executable is dropped immediately, defenses that rely solely on executable-file signatures may miss the activity.

What PapRAT Can Do and How It Is Evolving

The MSI installers primarily drop PapRAT onto infected systems. The malware masquerades as a Microsoft component named “bruzsvc.exe” with the product label “Microsoft redistributables.” Once running, PapRAT connects to a hardcoded command-and-control server over plain HTTP at regular intervals. The C2 address is XOR-encoded using the key 0x50. The malware identifies each victim by concatenating the username and the computer name with an underscore.

The initial PapRAT sample observed was written in C++ and supported eight commands: execute shell commands, list directories, delete files, execute programs, enumerate drives, capture screenshots, and upload or download files. In one chain, PapRAT used its download capability to retrieve a secondary tool named “vnces.exe,” identified as WmRAT—another RAT BITTER has used for system reconnaissance, screenshots, and remote command execution.

Fortinet also discovered a newer PapRAT implementation written in Rust. The Rust build contains the filename “requpap.pdb” and the product name “papsolutions,” which is the origin of the PapRAT name. Compared with the C++ variant, the Rust version uses HTTPS, delays startup for 42 seconds, then checks in every 5 seconds. It obfuscates constants using reversed text combined with a ROT-3 shift and expands the command set by three new items—PowerShell execution, sleep, and exit—bringing the total to eleven commands.

Defenders should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when they arrive unsolicited. Fortinet recommends monitoring for scripting tool usage, scheduled task creation, and installer activity rather than relying solely on file signatures. Correlating archive extraction, VHDX mounting, LNK execution, and WebDAV access in a single investigative view can improve detection—an approach also advised following analyses of the Russian RedFlick phishing campaigns.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally Q-defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.