BITTER PapRAT Cyberespionage + BADBOX Supply Chain Compromise: OTX Pulse Analysis — Enterprise Detection Pack

---
title: BITTER PapRAT - LNK File Invoking FTP.exe
id: 8f3e2a1c-4b5d-4e6f-9a7b-1c2d3e4f5a6b
status: experimental
description: Detects malicious LNK files invoking Windows ftp.exe, a known BITTER PapRAT infection vector
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
    - https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_image:
        Image|endswith: '\ftp.exe'
    selection_cmdline:
        CommandLine|contains:
            - '-s:'
            - '-A'
    condition: selection_parent and selection_image and selection_cmdline
falsepositives:
    - Legitimate FTP automation scripts (rare via Explorer)
level: high
tags:
    - attack.execution
    - attack.t1218
    - attack.t1218.011

---
title: BITTER PapRAT - VHDX Mount Followed By MSI Execution
id: 9a4f3b2d-5c6e-5f7a-8b9c-2d3e4f5a6b7c
status: experimental
description: Detects VHDX file mount followed by MSI installer execution, a BITTER PapRAT delivery method
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
    - https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat
logsource:
    category: process_creation
    product: windows
detection:
    selection_msiexec:
        Image|endswith: '\msiexec.exe'
    selection_vhdx_path:
        CommandLine|contains:
            - '.vhdx'
            - 'vhd'
    timeframe: 5m
    condition: selection_msiexec and selection_vhdx_path
falsepositives:
    - IT administrators deploying software from VHDX images
level: high
tags:
    - attack.execution
    - attack.t1204
    - attack.t1204.002

---
title: BADBOX - Suspicious MQTT C2 Communication
id: 1b5c4d3e-6f7a-6b8c-9d0e-3f4a5b6c7d8e
status: experimental
description: Detects MQTT connections to suspicious external IPs, potential BADBOX x.cpe backdoor C2
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
    - https://synthient.com/blog/the-internals-of-a-badbox-operation
logsource:
    category: network_connection
    product: windows
detection:
    selection_mqtt_port:
        DestinationPort:
            - 1883
            - 8883
    selection_external:
        DestinationIp|cidr:
            - '0.0.0.0/0'
    filter_internal:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    filter_known:
        DestinationHostname|contains:
            - 'amazonaws.com'
            - 'azure.com'
            - 'googlecloud.com'
    condition: selection_mqtt_port and selection_external and not filter_internal and not filter_known
falsepositives:
    - Legitimate IoT device telemetry
    - Development/testing MQTT connections
level: medium
tags:
    - attack.command_and_control
    - attack.t1071

// BITTER PapRAT + BADBOX Hunt Query
// Hunt for infection artifacts and C2 communication

let bitter_domains = dynamic([
    "techtalkhelp.com",
    "netmansrvdns.com",
    "rivingtonclarks.com",
    "felixfuturenext.com",
    "goodnfortunes.com",
    "rappellingaart.com"
]);
let badbox_ips = dynamic([
    "219.134.163.210"
]);
let badbox_hostnames = dynamic([
    "api.package.coreservice.io",
    "bmw.bestipip.com"
]);

// Union all detection logic
union isfuzzy=true
    // BITTER: FTP.exe spawned from LNK/Explorer
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "ftp.exe"
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where ProcessCommandLine has_any ("-s:", "-A")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, DetectionType="BITTER_FTP_LOLBIN"),
    
    // BITTER: MSI execution with VHDX reference
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "msiexec.exe"
    | where ProcessCommandLine has_any (".vhdx", ".vhd")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, DetectionType="BITTER_VHDX_MSI"),
    
    // BITTER: Network connections to C2 domains
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (bitter_domains)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, DetectionType="BITTER_C2_DOMAIN"),
    
    // BADBOX: Connections to known bad IPs
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIP in (badbox_ips)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, DetectionType="BADBOX_C2_IP"),
    
    // BADBOX: Connections to known bad hostnames
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (badbox_hostnames)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, DetectionType="BADBOX_C2_HOSTNAME"),
    
    // BADBOX: MQTT traffic to external IPs
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort in (1883, 8883)
    | where not(RemoteIP startswith "10.")
    | where not(RemoteIP startswith "192.168.")
    | where not(RemoteIP startswith "172.")
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, DetectionType="BADBOX_MQTT_EXTERNAL")

| sort by TimeGenerated desc

# BITTER PapRAT + BADBOX IOC Hunt Script
# Checks for registry persistence, suspicious files, and network connections
# Requires: Administrative privileges, PowerShell 5.1+

Write-Host "=== BITTER PapRAT + BADBOX IOC Hunt ===" -ForegroundColor Cyan
Write-Host "Scan started: $(Get-Date)" -ForegroundColor Gray

$findings = @()

# BITTER C2 Domains
$bitterDomains = @(
    "techtalkhelp.com",
    "netmansrvdns.com",
    "rivingtonclarks.com",
    "felixfuturenext.com",
    "goodnfortunes.com",
    "rappellingaart.com"
)

# BADBOX Infrastructure
$badboxIPs = @("219.134.163.210")
$badboxHosts = @("api.package.coreservice.io", "bmw.bestipip.com")

# Known malicious hashes
$maliciousHashes = @(
    "a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c",
    "ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88"
)

# Check 1: Registry Run Keys for suspicious entries
Write-Host "`n[*] Checking Registry Run Keys..." -ForegroundColor Yellow
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $entries = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
        $entries.PSObject.Properties | ForEach-Object {
            $value = $_.Value
            if ($value -match "powershell|ftp\.exe|msiexec|\.vhdx|\.lnk" -and $value -notmatch "Windows|Microsoft|Defender") {
                $findings += [PSCustomObject]@{
                    Type = "Registry Persistence"
                    Location = "$key\$($_.Name)"
                    Value = $value
                    Severity = "HIGH"
                }
                Write-Host "  [!] Suspicious Run Key: $($_.Name) = $value" -ForegroundColor Red
            }
        }
    }
}

# Check 2: Scheduled Tasks for suspicious entries
Write-Host "`n[*] Checking Scheduled Tasks..." -ForegroundColor Yellow
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskPath -notlike "\Microsoft*" -and 
    ($_.Actions.Execute -match "powershell|ftp|msiexec" -or $_.Actions.Arguments -match "-enc|-w hidden|iex")
}
foreach ($task in $tasks) {
    $findings += [PSCustomObject]@{
        Type = "Scheduled Task"
        Location = $task.TaskPath + $task.TaskName
        Value = "$($task.Actions.Execute) $($task.Actions.Arguments)"
        Severity = "HIGH"
    }
    Write-Host "  [!] Suspicious Task: $($task.TaskName)" -ForegroundColor Red
}

# Check 3: Active network connections to C2 infrastructure
Write-Host "`n[*] Checking Active Network Connections..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $connections) {
    try {
        $resolved = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
    } catch {
        $resolved = $null
    }
    
    # Check BADBOX IPs
    if ($badboxIPs -contains $conn.RemoteAddress) {
        $findings += [PSCustomObject]@{
            Type = "C2 Connection"
            Location = $conn.RemoteAddress
            Value = "BADBOX C2 - Port $($conn.RemotePort)"
            Severity = "CRITICAL"
        }
        Write-Host "  [!!!] BADBOX C2 Connection: $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
    }
    
    # Check MQTT ports to external IPs
    if (($conn.RemotePort -eq 1883 -or $conn.RemotePort -eq 8883) -and 
        $conn.RemoteAddress -notmatch "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)") {
        $findings += [PSCustomObject]@{
            Type = "MQTT External"
            Location = "$($conn.RemoteAddress):$($conn.RemotePort)"
            Value = "Potential BADBOX x.cpe C2"
            Severity = "HIGH"
        }
        Write-Host "  [!] External MQTT: $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
    }
}

# Check 4: DNS cache for BITTER domains
Write-Host "`n[*] Checking DNS Cache for BITTER C2..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dnsCache) {
    foreach ($domain in $bitterDomains) {
        if ($entry.Name -like "*$domain*") {
            $findings += [PSCustomObject]@{
                Type = "DNS Resolution"
                Location = $entry.Name
                Value = "BITTER C2 Domain Resolved"
                Severity = "CRITICAL"
            }
            Write-Host "  [!!!] BITTER C2 in DNS Cache: $($entry.Name)" -ForegroundColor Red
        }
    }
}

# Check 5: Recent LNK files in suspicious locations
Write-Host "`n[*] Checking for Recent LNK Files..." -ForegroundColor Yellow
$lnkPaths = @("$env:TEMP", "$env:APPDATA", "$env:USERPROFILE\Downloads")
foreach ($path in $lnkPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Filter "*.lnk" -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
        ForEach-Object {
            $findings += [PSCustomObject]@{
                Type = "Recent LNK File"
                Location = $_.FullName
                Value = "Modified: $($_.LastWriteTime)"
                Severity = "MEDIUM"
            }
            Write-Host "  [?] Recent LNK: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}

# Summary
Write-Host "`n=== HUNT COMPLETE ===" -ForegroundColor Cyan
Write-Host "Total findings: $($findings.Count)" -ForegroundColor $(if ($findings.Count -gt 0) { "Red" } else { "Green" })

if ($findings.Count -gt 0) {
    Write-Host "`nFindings exported to: .\ioc_hunt_findings_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -ForegroundColor Yellow
    $findings | Export-Csv -Path ".\ioc_hunt_findings_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
}

$findings | Format-Table -AutoSize