Bitter PapRAT: abc.pdf recon staging then curl upload within 30 minutes

ills3c Intel&Coffee@Ills3C

•updated yesterday•10•0•11

Detects behavior associated with the Bitter APT group where system reconnaissance commands are executed via command shells (powershell, cmd), staged into a local file named 'abc.pdf' using output redirection, and subsequently uploaded/exfiltrated using curl within a 30-minute window.