Back Darkreading

PapRAT Cyber Espionage Campaign Leaves a 'BITTER' Taste in South Asia

Darkreading •Elizabeth Montalbano • November 2, 2026

Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.

A known South Asian cyber espionage group has been targeting organizations across the region with attacks designed to compromise Windows systems, establish persistence, and give attackers remote control over infected machines using custom malware.

The attacks, attributed "with high confidence" to the South Asian threat group known as BITTER (aka TA397), involve three distinct infection chains and demonstrate the group's expanding malware capabilities, according to new research from FortiGuard Labs published today.

BITTER, one of several threat groups linked to India , has been active since at least 2013 and has historically targeted government, energy, and engineering organizations. The group is known for using tailored attack campaigns to gain persistent access to victim networks, collect information, and maintain remote control over compromised systems.

At the center of the latest threat campaign is PapRAT, a custom remote access Trojan (RAT) that gives attackers extensive control over compromised Windows systems, including the ability to execute commands, manipulate files, capture screenshots, and download additional payloads, according to FortiGuard Labs.

Related: Devs Hit by Trojanized Claude Code Extension for Cursor

"This campaign illustrates how BITTER combines native Windows tools with custom malware to establish and maintain access to targeted systems," Cara Lin, a FortiGuard Labs threat researcher, wrote in the post.

BITTER has recently revamped PapRAT from a C++ code base to Rust , expanding its functionality in the process from eight commands to 11, according to the report. Additional capabilities in the latest version include PowerShell execution, a sleep directive, and a clean-exit command.

"PapRAT's C++ and Rust implementations indicate continued investment in BITTER's toolset," Lin wrote.

Indeed, attackers have increasingly adopted Rust for malware development for various reasons, including its cross-platform development capabilities and potential evasion advantages.

The latest updates to PapRAT also underscore the importance of certain defensive measures, including "monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures," Lin wrote.

Researchers observed three distinct attack chains being used by BITTER, all of which exploit legitimate Windows functionality to disguise malicious behavior.

These tactics demonstrate "how advanced cyberespionage operations deliberately abuse native system tools to evade traditional endpoint detection," notes Shane Barney, chief information security officer at Keeper Security.

Related: Anthropic-Themed Phishing Emails Bypass Top Security Tools

The first attack chain uses a malicious LNK file that abuses the native Windows ftp.exe utility to execute scripts and create scheduled tasks that maintain with the attackers' command-and-control (C2) server.

The second uses a VHDX disk image containing an LNK file that opens a decoy spreadsheet while silently launching an MSI installer to deploy PapRAT.

The third attack begins with a URL shortcut that retrieves an LNK file through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers, according to FortiGuard Labs.

"By co-opting native Windows utilities like ftp.exe and scheduled tasks to establish initial command-and-control communication, threat actors operate within trusted administrative channels before deploying custom malware," Barney observes. "When an intrusion leverages trusted system processes, signature-based controls simply have nothing to alert on."

Defending PapRAT Attacks

This so-called "hybrid tradecraft," which combines legitimate Windows functionality with custom malware, requires organizations to focus on strict privilege boundaries and identity security rather than relying on endpoint signatures alone as part of a comprehensive defense strategy, Barney says.

Related: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

To defend against these attacks, organizations should treat unexpected LNK files , URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages, Lin recommended in the post.

"Combining user awareness with controls that detect suspicious execution chains and outbound C2 traffic can help limit exposure to campaigns that blend legitimate Windows functionality with custom malware," she wrote.

The third attack chain is particularly problematic for defenders because removing PapRAT from compromised systems may not eliminate the attacker's access, observes Jason Soroko, senior fellow at Sectigo.

This means defenders need to look deeper into their systems "to check what else was installed and identify scripts and scheduled tasks that could keep fetching commands," he says. A comprehensive recovery effort must look beyond the file that triggered the original alert to identify any additional payloads, persistence mechanisms, or other components of the compromise.

Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician.

Want more Dark Reading stories in your Google results?

The Autonomous Endpoint Management Advantage

2026 State of Cybersecurity Report: Bridging the Divide

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

LLM Security Architecture: Building Secure AI Systems from the Ground Up

Resilient Architecture: Designing Systems That Survive Compromise

Prompt Injection 101: What It Is and How to Stay Ahead

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk

How to Harness your Security Operations Data for Enterprise Defense

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BITTER Group Launches PapRAT Cyber Espionage Campaign in South Asia A South Asian cyber espionage group known as BITTER has been observed targeting organizations in South Asia with a campaign utilizing a custom remote access Trojan (RAT) named PapRAT. This campaign, detailed by FortiGuard Labs, employs three distinct infection chains that exploit native Windows tools to maintain access without deploying traditional malware binaries. The first chain uses a malicious LNK file to abuse the ftp.exe utility, while the other two chains deliver PapRAT through Windows Installer packages disguised as decoy files. BITTER has transitioned PapRAT from a C++ code base to Rust, enhancing its capabilities and evasion techniques. The campaign has been tracked over several months, with targets primarily in South Asia, but also showing activity in Southeast Asia and South Korea. FortiGuard Labs emphasizes the need for heightened monitoring of legitimate Windows functionalities to detect such advanced threats. 3 sources 61

Extracted Entities

PapRAT Cyber Espionage Campaign Leaves a 'BITTER' Taste in South Asia

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Campaigns (1)

Countries (1)

Industries (3)

Malware (2)

MITRE ATT&CK (3)

Platforms (2)

Tools (2)