Bitter's New PapRAT Backdoor Arrives as an LNK, a Disk Image or a URL Shortcut Dressed as Diplomatic Mail. Fortinet Published the Domains and Hashes. Here Is What to Block and Hunt
If your organization works with South Asian governments, embassies or defense and energy contractors, block the domains below and search mail and endpoint logs for LNK files, URL shortcuts, disk images (VHDX) and MSI installers that arrived as meeting invitations or ambassador letters. Fortinet FortiGuard Labs, the researcher behind the primary report, rates the link to the Bitter group as high confidence. The infection starts with a file the user opens, not an exploit, so the fix is mostly mail and endpoint rules.
What has been reported
The primary source is Fortinet's post by Cara Lin, dated November 2, 2026. The Hacker News summarized it on November 9. Fortinet's telemetry is concentrated in South Asia and it names no victims. Bitter (also tracked as APT-C-08, TA397 and Hazy Tiger, among other names) has historically gone after government, energy and engineering targets.
PapRAT is a backdoor with C++ and Rust versions. Both can run commands, upload and download files, delete files, list directories and drives, and take screenshots. The Rust version adds PowerShell execution, a sleep command and a process-termination command. Fortinet says its commands are updated on the server without pushing a new binary, which avoids dropping a new executable or injecting into a process.
Three infection chains are described:
A Windows LNK file abuses the built-in ftp.exe to run scripts and create scheduled tasks that keep contact with the attacker's server. Lures include a document titled "update on Avn Comd and Staff program" and one referencing a bilateral meeting request.
A VHDX disk image named for a letter from an ambassador about a Belt and Road summit holds an LNK that opens a decoy spreadsheet while an MSI installer deploys PapRAT in the background.
A URL shortcut inside an archive posing as an invitation to a gala dinner fetches an LNK over WebDAV, which leads to an MSI installer. This chain drops WmRAT, which Fortinet says Bitter used before and which is part of its link to Bitter.
The early scripts collect directory and task lists, antivirus product data, mounted drives and file lists from Desktop, Documents and Downloads. They save the result as a file called abc.pdf, send it with curl and delete it. A second script fetches talk.log and runs Base64-encoded PowerShell from the same server.
Fortinet's attribution rests on lure filenames, command-server patterns, file metadata, the PapRAT code and a fruit-word naming habit seen in earlier Bitter tools. It did not publish more detail than that, and we did not examine the samples.
Indicators Fortinet published
Hostnames: netmansrvdns[.]com (the WmRAT server) and rappellingaart[.]com.
URLs: techtalkhelp[.]com/talk.log, rivingtonclarks[.]com/beautiQuewonders/banaNa.php, goodnfortunes[.]com/ucl.php, felixfuturenext[.]com/Epistemological/ and gomescareerplans[.]com/docs.
Fortinet's text also mentions chestergreenfarming[.]com. The Hacker News's list differs slightly from Fortinet's list. Fortinet's list is the one to use.
File hashes (SHA-256): three LNK files, one PapRAT and one WmRAT. They are in Fortinet's post: a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c, e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b and ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88 for the LNK files, 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33 for PapRAT and 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b for WmRAT.
No IP addresses are listed.
What to do
Block the domains above at DNS and the web proxy, and search proxy and DNS logs back to at least October for them.
Treat LNK files, URL shortcuts, VHDX and ISO images and MSI packages arriving by mail as suspect. Block or quarantine disk images and shortcut files from external mail where you do not need them.
Hunt for ftp.exe launched from a shortcut or script, scheduled tasks you did not create, files named abc.pdf or talk.log, and curl uploads from user profiles. Fortinet also names a file called bruzsvc.exe posing as a Microsoft file, though we did not confirm that in the text we read.
If an endpoint opened one of these, assume the data in the user's Desktop, Documents and Downloads folders was read and sent.
Fortinet lists detection names for its own products: LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/PapRAT.A!tr and W32/WmRAT.A!tr. Note that one section of Fortinet's post mentions a "fileless SectopRAT payload", which does not match the rest of the report, so verify before relying on that part.
What is not known
Who was targeted. How many victims there are. How the lures were delivered. The evidence behind the attribution beyond what Fortinet summarizes.
How we know, and how we checked
We read Fortinet's post and The Hacker News report. The news report is a summary of the Fortinet research, so these are one source, not two. We checked our own corpus for the domains: goodnfortunes[.]com is already in our index at confidence 70, from a community social-media feed that first listed it on September 24, 2026; techtalkhelp[.]com and rivingtonclarks[.]com were not in it. The September record is a third-party feed's observation, not ours, and an ingest date is not a detection date, so we make no claim to have seen this campaign first. We did not examine any sample.
We added Fortinet's published indicators to our feed on November 9, 2026, under the source manual-batch-bitter-paprat-fortinet-2026-11, each cited to Fortinet and none presented as our sighting: five hosts at confidence 80, two URL hosts whose role Fortinet does not describe at 70, and the five hashes at 85. We left out chestergreenfarming[.]com, which Fortinet mentions in its text but not in its list. A confidence of 70 is below the 80 our own edge shield needs to block, though default domain downloads carry it. We read each record back after writing it.
Sources
Fortinet FortiGuard Labs, "Bitter expands its arsenal with PapRAT," November 2, 2026. The Hacker News, "Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia," November 9, 2026.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. The question lives here: https://analytics.dugganusa.com/nps.html#post=bitter-paprat-backdoor-lnk-vhdx-msi-fortinet
Comments