Fortinet researchers detail a cyberespionage campaign by the Bitter APT group targeting South Asian organizations using PapRAT, a custom remote access trojan written in C++ and Rust with multi-stage infection chains.
According to security researchers at Fortinet, the program is written in two different programming languages and allows attackers to execute commands, manage files, check available disks, and take screenshots of compromised computers. The Rust variant also has the ability to execute commands through Windows' built-in automation tools.
The perpetrators use three different methods to trick victims into installing the program:
- They use simple Windows shortcuts that leverage built-in system tools to run hidden scripts and create automated tasks.
- They use digital disk images that contain shortcuts that open spreadsheet files to distract attention, while running installation programs in the background.
- They use shortcuts that download files via special network protocols to ultimately lead to the installation of the program.
In some cases, the attack collects information about users' folders, installed security programs, and connected drives. This data is temporarily stored, sent to the attackers' servers, and then deleted from the computer to leave no trace.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Zyxel fixes serious issue that left thousands of network devices exposed
↗
This development shows that perpetrators are constantly improving their tools to maintain access to organizations' systems in the region, combining classic deception methods with new remote control programs.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)