Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware

A suspected espionage group is sending fake meeting letters and event invitations to organizations in South Asia. The files look harmless, but they quietly install a custom remote access trojan called PapRAT on Windows computers.

The campaign uses Windows disk images, shortcut files, and remote web folders to avoid easy detection. The activity points to BITTER, a group believed to be based in South Asia and active since at least 2013.

It has a history of targeting government, energy, and engineering organizations. Readers who follow the Bitter group’s custom-developed tools will see that PapRAT is another sign of steady investment in its malware toolkit.

Researchers from Fortinet’s FortiGuard Labs identified the malware while tracking the campaign for several months.

They linked it to BITTER with high confidence based on lure file names, command-and-control (C2) traffic patterns, file details, and malware analysis. They found three separate infection chains, and two of them rely on VHDX files and WebDAV links.

Hackers Use Malicious VHDX Files and WebDAV Links

The second infection chain starts with a VHDX file, which is a virtual hard disk image that Windows can mount like a USB drive. In one case, the file was named “Letter from the Ambassador – 11th Belt and Road Summit.”

Once opened, it shows a single visible shortcut (LNK) file. Two hidden files sit beside it: a decoy spreadsheet called “Attachment-2.xls” and an installer called “Visa_Details.msi”.

When the victim clicks the shortcut, it runs a command that starts the installer in the background and opens the spreadsheet at the same time.

The victim sees a normal document and has no reason to be suspicious. This trick is not unique to BITTER. Earlier, APT-C-60 weaponized VHDX files in a similar way against recruiters in Japan.

The third chain uses WebDAV, a Windows feature that lets a computer open files on a remote web server as if they were local. It begins with an archive named “Official Invitation Majilis 2026 Gala Dinner.rar.”

Inside is a URL shortcut that connects to a remote server and pulls down a shortcut file and a script. That script creates a scheduled task, contacts the attacker’s server, and then installs a second MSI file called “Imp_Details.msi”.

Attackers like WebDAV because the remote folder looks like a normal local folder. Cofense researchers have reported that this connection skips the usual browser warnings, which is why abuse of Windows File Explorer has become a growing delivery method for remote access trojans.

The first chain is the quietest. A shortcut file abuses the built-in Windows ftp.exe tool to run a hidden script. It then sets up scheduled tasks with names such as “MicrosoftUpdates” and uses curl to reach the attacker’s server.

A fake pop-up tells the victim that Explorer could not open the file. No traditional malware file is dropped at this stage, so security tools that look only for executables may miss it.

What PapRAT Can Do and How It Is Changing

Inside the MSI installer, the only real action is a custom step that drops PapRAT onto the machine. The file pretends to be a Microsoft component named “bruzsvc.exe” with the product name “Microsoft redistributables.”

Once running, it contacts a hardcoded C2 server over plain HTTP every 10 seconds. The server address is hidden with XOR encoding using the key 0x50. It identifies each victim by joining the username and computer name with an underscore.

The first version of PapRAT is written in C++ and understands eight commands. These let the attacker run shell commands, list folders, delete files, run programs, list drives, take screenshots, and upload or download files.

In the third chain, PapRAT used its download command to fetch a second tool, “vnces.exe,” which is WmRAT. WmRAT is another remote access trojan that BITTER uses for system information, screenshots, and command execution.

Fortinet also found a newer version written in Rust. The name PapRAT comes from this build, which contains the file name “requpap.pdb” and the product name “papsolutions.”

The Rust version uses HTTPS, waits 42 seconds before starting, and then checks in every 5 seconds. It hides its constants with reversed text and a ROT-3 shift. It also adds three commands for PowerShell execution, sleeping, and exiting, which raises the total to eleven.

Defenders should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, especially when they arrive in unsolicited messages.

Fortinet advises watching scripting tools, scheduled tasks, and installer activity instead of relying only on file signatures.

Teams can also learn from the Russian RedFlick phishing campaigns, where researchers advised linking archive extraction, VHDX mounting, LNK execution, and WebDAV activity in one view.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware appeared first on Cyber Security News.