[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0zzPNBpbAj1MKDzLX6L0Eegz2npdyIzN4yDphexQk6o":3},{"article":4,"iocs":54,"watch_terms":71,"solutions":72,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"000f3147-b00c-46a8-addc-6eb50bb53135","Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware","hackers-use-malicious-vhdx-files-and-webdav-links-to-infect-windows-devices-with-05fcd2","A suspected espionage group is sending fake meeting letters and event invitations to organizations in South Asia. The files look harmless, but they quietly install a custom remote access trojan called PapRAT on Windows computers. The campaign uses Windows disk images, shortcut files, and remote web folders to avoid easy detection. The activity points to […] The post Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware appeared first on Cyber Security News.","A suspected espionage group believed to be BITTER is conducting a campaign against organizations in South Asia using fake meeting letters and event invitations that deliver a custom remote access trojan called PapRAT. The attack uses three infection chains leveraging Windows disk images (VHDX), WebDAV links, and hidden shortcut files to evade detection. Fortinet's FortiGuard Labs identified the malware and linked it to BITTER with high confidence based on lure file names, C2 traffic patterns, and malware analysis.","BITTER APT group deploys PapRAT malware via malicious VHDX files and WebDAV links targeting South Asian organizations.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-malicious-vhdx-files\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-Malicious-VHDX-Files-and-WebDAV-Links-to-Infect-Windows-Devices-With-PapRAT-Malware.webp","2026-11-03T06:44:36+00:00","2026-11-03T07:00:36.216382+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"BITTER","threat_actor",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":25},"FortiGuard Labs","product",{"name":27,"type":28},"VHDX","technology",{"name":30,"type":28},"WebDAV",{"name":32,"type":19},"APT-C-60","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,61,65,68],{"type":37,"value":56,"context":57},"PapRAT","Custom remote access trojan deployed by BITTER group; pretends to be Microsoft redistributables (bruzsvc.exe)",{"type":37,"value":59,"context":60},"vnces.exe","Second tool downloaded by PapRAT via its download command",{"type":62,"value":63,"context":64},"mitre_attack","T1566.002","Phishing: Spearphishing Attachment (fake meeting letters and event invitations)",{"type":62,"value":66,"context":67},"T1566.001","Phishing: Spearphishing Link (WebDAV-based delivery)",{"type":62,"value":69,"context":70},"T1559.003","Command and Scripting Interpreter: Windows Command Shell (ftp.exe, curl abuse)",[21,24],{"controls":73,"vendors":158},[74,103,129],{"slug":75,"name":76,"problem":77,"products":78},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,121],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":117,"product_name":118,"url":119,"description":120},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":130,"name":131,"problem":132,"products":133},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[159],{"slug":160,"name":21,"logo_path":161,"roles":162},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":176},"bitter-group-uses-vhdx-and-webdav-lures-to-deliver-paprat-via-social-engineering","BITTER Group Uses VHDX and WebDAV Lures to Deliver PapRAT via Social Engineering","The BITTER espionage group is exploiting user trust by disguising malware inside convincing fake meeting invitations and event letters, using Windows disk images (VHDX), WebDAV links, and hidden shortcut files to bypass traditional security controls. The root cause lies in insufficient user awareness around suspicious file types and links, combined with permissive system configurations that allow mounting of arbitrary disk images and unauthenticated WebDAV connections. This matters because spear-phishing with novel file formats is an increasingly effective way to evade email and endpoint security tools that may not inspect VHDX containers or remote WebDAV-hosted payloads. Once PapRAT is installed, attackers gain persistent remote access, enabling espionage, data exfiltration, and lateral movement. Organizations must combine user education with technical controls to close the gap between what security tools inspect and what users are willing to click.",[169,170,171,172,173,174,175],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"MITRE ATT&CK T1566: Phishing":177,"NIST SP 800-53 SI-2: Flaw Remediation":178,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":179,"CIS Control 14: Security Awareness and Skills Training":180,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":181,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":182,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":183},"The entire initial infection vector relies on spear-phishing via fake meeting invitations, directly matching this technique; understanding and detecting T1566 sub-techniques (including malicious attachments and links) would have been the first line of defence.","While the attack leverages social engineering rather than a software flaw, SI-2's broader mandate for maintaining secure system configurations and removing unnecessary features applies directly to stripping WebDAV and VHDX mount capabilities from endpoints.","This clause requires organizations to ensure personnel have the awareness and competence to recognise security threats; staff able to identify social engineering lures disguised as official meeting communications would have halted the attack at the phishing stage.","Employees who received the fake meeting invitations and event lures represent the primary attack surface; recurring, role-based security awareness training specifically covering unusual file types and unsolicited links would reduce the likelihood of user execution.","Beyond patching, A.8.8 encompasses the identification and mitigation of technical weaknesses including insecure default configurations; proactively assessing and disabling risky Windows features such as WebDAV and auto-mounting of disk images falls under this control.","Default Windows configurations allow users to mount VHDX files and use WebDAV; hardening endpoints by disabling the WebClient service and restricting disk image mounting through Group Policy would have broken the infection chain before payload delivery.","Restricting which users and processes can mount disk images or initiate WebDAV sessions enforces least-privilege principles that would limit the attacker's ability to execute the infection chain even if a user clicked the lure."]