BITTER’s native-tool chain slips past malware-only hunts
FortiGuard Labs attributes a campaign against South and Southeast Asian organizations to BITTER (TA397) with high confidence, documenting three Windows infection chains, one of which deploys no malware executable. The other two deliver PapRAT, a remote access Trojan; its newer Rust version adds commands and switches communications to HTTPS.
The executable-free chain starts with a malicious Windows shortcut that uses built-in ftp.exe to run scripts and create scheduled tasks. Those tasks use curl to fetch instructions from an attacker-controlled server. Because operators can change the instructions there, they can change what an infected host does without sending a new malware file.
If your Windows estate is among BITTER’s regional targets, a hunt focused on PapRAT binaries can miss one chain entirely. The server-side changes also mean a search for a known payload may not capture later activity through trusted Windows utilities and scheduled tasks.