BITTER APT uses counterfeit diplomatic files and .lnk shortcuts to deliver PapRAT

Key points

• FortiGuard Labs tied the activity to BITTER APT.
• Lures are counterfeit diplomatic documents.
• Weaponized .lnk files launch PowerShell code.
• Payload is PapRAT, used for espionage.
• No CVE is involved; user execution is key.

FortiGuard Labs has attributed a fresh espionage campaign to BITTER APT, a group tracked targeting entities across South Asia. The lure is counterfeit diplomatic paperwork, which appears designed to appeal to government and policy-focused recipients. Rather than relying on a software vulnerability, the operation depends on convincing a user to open an attached or linked file.

The delivery chain uses weaponized Windows shortcut (.lnk) files. When launched, these shortcuts invoke PowerShell code, which then pulls down and runs PapRAT. PapRAT is described as spyware, and its presence indicates the goal is intelligence collection rather than disruptive or financially motivated activity. FortiGuard Labs' analysis names Fortinet as the vendor behind the research; no CVE is associated with this chain.

The targeting is geographically focused on organizations in South Asia, but the tradecraft is broadly relevant. Shortcut files and PowerShell are common in Windows environments, and both can be abused without exploiting a missing patch. That makes email filtering, attachment handling, and endpoint controls more important than patch status alone for this specific campaign.

For K-12 and government defenders, the practical risk is a user opening a file that looks like a diplomatic document. Because the payload is spyware, the impact may be quiet: credential theft, document collection, and long-term access. The absence of a CVE does not mean low priority; it means the initial access relies on social engineering and user execution.

Watch for .lnk attachments or archives containing shortcuts, PowerShell spawned by Explorer or Office, and outbound connections to unfamiliar infrastructure. FortiGuard Labs' reporting should be used to tune detections and block known indicators where available. Organizations in South Asia are the stated focus, but similar lures can be reused elsewhere.

What to do now

1. Block or quarantine .lnk attachments at the email gateway and inspect archives for shortcut files.
2. Constrain PowerShell for standard users, enable script block logging, and alert on unusual PowerShell launches.
3. Enable Windows Attack Surface Reduction rules that block Office and Explorer child processes and suspicious shortcut execution.
4. Hunt for .lnk files that spawn powershell.exe, especially from downloads, temp, or email attachment paths.
5. Warn staff about counterfeit diplomatic lures and make reporting suspicious attachments easy.
6. Apply endpoint detections for PapRAT indicators from FortiGuard Labs and restrict outbound command-and-control traffic.
7. Treat this as user-execution risk rather than a patch gap: review attachment controls, endpoint hardening, and general patching hygiene.

Original source

Hackread