[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIuZuFPOqT3WiUm7FYkMQsUWCXoRQnEJwDd5MrDIHfrM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"20abc78d-b36d-4d3f-b6b6-30c8314f689e","bitter-group-uses-vhdx-and-webdav-lures-to-deliver-paprat-via-social-engineering","000f3147-b00c-46a8-addc-6eb50bb53135","BITTER Group Uses VHDX and WebDAV Lures to Deliver PapRAT via Social Engineering","The BITTER espionage group is exploiting user trust by disguising malware inside convincing fake meeting invitations and event letters, using Windows disk images (VHDX), WebDAV links, and hidden shortcut files to bypass traditional security controls. The root cause lies in insufficient user awareness around suspicious file types and links, combined with permissive system configurations that allow mounting of arbitrary disk images and unauthenticated WebDAV connections. This matters because spear-phishing with novel file formats is an increasingly effective way to evade email and endpoint security tools that may not inspect VHDX containers or remote WebDAV-hosted payloads. Once PapRAT is installed, attackers gain persistent remote access, enabling espionage, data exfiltration, and lateral movement. Organizations must combine user education with technical controls to close the gap between what security tools inspect and what users are willing to click.","**Immediate actions:**\n- Block or restrict the mounting of VHDX\u002FVHD disk image files via Group Policy and endpoint controls, as standard users have no legitimate need to mount arbitrary disk images.\n- Disable or tightly restrict WebDAV client functionality (WebClient service) on all Windows endpoints that do not require it.\n- Configure email and web gateways to quarantine or strip messages containing VHDX attachments, WebDAV URLs, and hidden LNK shortcut files.\n\n**Detection measures:**\n- Enable detailed process creation and file system logging (e.g., Sysmon Event ID 1, 11) to detect VHDX mount activity and suspicious shortcut execution.\n- Deploy network monitoring rules to flag outbound connections to WebDAV endpoints and known C2 traffic patterns associated with PapRAT.\n\n**Long-term improvements:**\n- Conduct regular phishing simulation exercises using lure themes such as meeting invitations to train employees to recognize and report social engineering attempts.\n- Enforce application allowlisting to prevent unapproved executables—including those launched from mounted disk images—from running on endpoints.\n- Establish a formal process for reviewing and restricting Windows features (e.g., WebDAV, VHDX auto-mount) as part of ongoing system hardening reviews.",[12,13,14,15,16,17,18],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"MITRE ATT&CK T1566: Phishing":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":22,"CIS Control 14: Security Awareness and Skills Training":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"The entire initial infection vector relies on spear-phishing via fake meeting invitations, directly matching this technique; understanding and detecting T1566 sub-techniques (including malicious attachments and links) would have been the first line of defence.","While the attack leverages social engineering rather than a software flaw, SI-2's broader mandate for maintaining secure system configurations and removing unnecessary features applies directly to stripping WebDAV and VHDX mount capabilities from endpoints.","This clause requires organizations to ensure personnel have the awareness and competence to recognise security threats; staff able to identify social engineering lures disguised as official meeting communications would have halted the attack at the phishing stage.","Employees who received the fake meeting invitations and event lures represent the primary attack surface; recurring, role-based security awareness training specifically covering unusual file types and unsolicited links would reduce the likelihood of user execution.","Beyond patching, A.8.8 encompasses the identification and mitigation of technical weaknesses including insecure default configurations; proactively assessing and disabling risky Windows features such as WebDAV and auto-mounting of disk images falls under this control.","Default Windows configurations allow users to mount VHDX files and use WebDAV; hardening endpoints by disabling the WebClient service and restricting disk image mounting through Group Policy would have broken the infection chain before payload delivery.","Restricting which users and processes can mount disk images or initiate WebDAV sessions enforces least-privilege principles that would limit the attacker's ability to execute the infection chain even if a user clicked the lure.","published","2026-11-03T07:20:26.379851+00:00","2026-11-03T07:20:26.358+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-malicious-vhdx-files\u002F","hackers-use-malicious-vhdx-files-and-webdav-links-to-infect-windows-devices-with-05fcd2","Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]