Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware

A suspected espionage group is sending fake meeting letters and event invitations to organizations in South Asia. The files look harmless, but they quietly install a custom remote access trojan called PapRAT on Windows computers.

The campaign uses Windows disk images, shortcut files, and remote web folders to avoid easy detection. The activity points to BITTER, a group believed to be based in South Asia and active since at least 2013.

It has a history of targeting government, energy, and engineering organizations. Readers who follow the Bitter group’s custom-developed tools will see that PapRAT is another sign of steady investment in its malware toolkit.

Researchers from Fortinet’s FortiGuard Labs identified the malware while tracking the campaign for several months.

They linked it to BITTER with high confidence based on lure file names, command-and-control (C2) traffic patterns, file details, and malware analysis. They found three separate infection chains, and two of them rely on VHDX files and WebDAV links.

Hackers Use Malicious VHDX Files and WebDAV Links

The second infection chain starts with a VHDX file, which is a virtual hard disk image that Windows can mount like a USB drive. In one case, the file was named “Letter from the Ambassador – 11th Belt and Road Summit.”

Once opened, it shows a single visible shortcut (LNK) file. Two hidden files sit beside it: a decoy spreadsheet called “Attachment-2.xls” and an installer called “Visa_Details.msi”.

When the victim clicks the shortcut, it runs a command that starts the installer in the background and opens the spreadsheet at the same time.

The victim sees a normal document and has no reason to be suspicious. This trick is not unique to BITTER. Earlier, APT-C-60 weaponized VHDX files in a similar way against recruiters in Japan.

The third chain uses WebDAV, a Windows feature that lets a computer open files on a remote web server as if they were local. It begins with an archive named “Official Invitation Majilis 2026 Gala Dinner.rar.”

Inside is a URL shortcut that connects to a remote server and pulls down a shortcut file and a script. That script creates a scheduled task, contacts the attacker’s server, and then installs a second MSI file called “Imp_Details.msi”.

Attackers like WebDAV because the remote folder looks like a normal local folder. Cofense researchers have reported that this connection skips the usual browser warnings, which is why abuse of Windows File Explorer has become a growing delivery method for remote access trojans.

The first chain is the quietest. A shortcut file abuses the built-in Windows ftp.exe tool to run a hidden script. It then sets up scheduled tasks with names such as “MicrosoftUpdates” and uses curl to reach the attacker’s server.

A fake pop-up tells the victim that Explorer could not open the file. No traditional malware file is dropped at this stage, so security tools that look only for executables may miss it.

What PapRAT Can Do and How It Is Changing

Inside the MSI installer, the only real action is a custom step that drops PapRAT onto the machine. The file pretends to be a Microsoft component named “bruzsvc.exe” with the product name “Microsoft redistributables.”

Once running, it contacts a hardcoded C2 server over plain HTTP every 10 seconds. The server address is hidden with XOR encoding using the key 0x50. It identifies each victim by joining the username and computer name with an underscore.

The first version of PapRAT is written in C++ and understands eight commands. These let the attacker run shell commands, list folders, delete files, run programs, list drives, take screenshots, and upload or download files.

In the third chain, PapRAT used its download command to fetch a second tool, “vnces.exe,” which is WmRAT. WmRAT is another remote access trojan that BITTER uses for system information, screenshots, and command execution.

Fortinet also found a newer version written in Rust. The name PapRAT comes from this build, which contains the file name “requpap.pdb” and the product name “papsolutions.”

The Rust version uses HTTPS, waits 42 seconds before starting, and then checks in every 5 seconds. It hides its constants with reversed text and a ROT-3 shift. It also adds three commands for PowerShell execution, sleeping, and exiting, which raises the total to eleven.

Defenders should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, especially when they arrive in unsolicited messages.

Fortinet advises watching scripting tools, scheduled tasks, and installer activity instead of relying only on file signatures.

Teams can also learn from the Russian RedFlick phishing campaigns, where researchers advised linking archive extraction, VHDX mounting, LNK execution, and WebDAV activity in one view.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Hostname	netmansrvdns[.]com	WmRAT C2
Hostname	rappellingaart[.]com	Hosts shortcut, script, and MSI files
URL	hxxps://techtalkhelp[.]com/talk.log	Script download
URL	hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php	PapRAT C2
URL	hxxps://goodnfortunes[.]com/ucl.php	Data upload and C2
URL	hxxps://felixfuturenext[.]com/Epistemological/	Campaign URL
URL	hxxp://gomescareerplans[.]com/docs	Campaign URL
SHA256 (LNK)	a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c	Malicious shortcut
SHA256 (LNK)	e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b	Malicious shortcut
SHA256 (LNK)	ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88	Malicious shortcut
SHA256 (PapRAT)	569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33	PapRAT sample
SHA256 (WmRAT)	411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b	WmRAT sample

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.