BITTER Group Uses VHDX and WebDAV Lures to Deliver PapRAT via Social Engineering
Written by AI from the linked story. Not reviewed by an editor. How this works
The BITTER espionage group is exploiting user trust by disguising malware inside convincing fake meeting invitations and event letters, using Windows disk images (VHDX), WebDAV links, and hidden shortcut files to bypass traditional security controls. The root cause lies in insufficient user awareness around suspicious file types and links, combined with permissive system configurations that allow mounting of arbitrary disk images and unauthenticated WebDAV connections. This matters because spear-phishing with novel file formats is an increasingly effective way to evade email and endpoint security tools that may not inspect VHDX containers or remote WebDAV-hosted payloads. Once PapRAT is installed, attackers gain persistent remote access, enabling espionage, data exfiltration, and lateral movement. Organizations must combine user education with technical controls to close the gap between what security tools inspect and what users are willing to click.
Tactical Insight
Immediate actions
- Block or restrict the mounting of VHDX/VHD disk image files via Group Policy and endpoint controls, as standard users have no legitimate need to mount arbitrary disk images.
- Disable or tightly restrict WebDAV client functionality (WebClient service) on all Windows endpoints that do not require it.
- Configure email and web gateways to quarantine or strip messages containing VHDX attachments, WebDAV URLs, and hidden LNK shortcut files.
Detection measures
- Enable detailed process creation and file system logging (e.g., Sysmon Event ID 1, 11) to detect VHDX mount activity and suspicious shortcut execution.
- Deploy network monitoring rules to flag outbound connections to WebDAV endpoints and known C2 traffic patterns associated with PapRAT.
Long-term improvements
- Conduct regular phishing simulation exercises using lure themes such as meeting invitations to train employees to recognize and report social engineering attempts.
- Enforce application allowlisting to prevent unapproved executables—including those launched from mounted disk images—from running on endpoints.
- Establish a formal process for reviewing and restricting Windows features (e.g., WebDAV, VHDX auto-mount) as part of ongoing system hardening reviews.