BITTER Group Launches PapRAT Cyber Espionage Campaign in South Asia

Darkreading

BITTER Group Launches PapRAT Cyber Espionage Campaign in South Asia

First seen 2 Nov 2026, 15:12 UTC • •61.0

Article Content

1 / 6

Browse articles

ThreatCluster •November 2, 2026 at 19:47 UTC

•BITTER group targets South Asian organizations with PapRAT malware.
•Three distinct infection chains exploit native Windows tools for stealth.
•PapRAT has evolved from C++ to Rust, enhancing its capabilities.

A South Asian cyber espionage group known as BITTER has been observed targeting organizations in South Asia with a campaign utilizing a custom remote access Trojan (RAT) named PapRAT. This campaign, detailed by FortiGuard Labs, employs three distinct infection chains that exploit native Windows tools to maintain access without deploying traditional malware binaries. The first chain uses a malicious LNK file to abuse the ftp.exe utility, while the other two chains deliver PapRAT through Windows Installer packages disguised as decoy files. BITTER has transitioned PapRAT from a C++ code base to Rust, enhancing its capabilities and evasion techniques. The campaign has been tracked over several months, with targets primarily in South Asia, but also showing activity in Southeast Asia and South Korea. FortiGuard Labs emphasizes the need for heightened monitoring of legitimate Windows functionalities to detect such advanced threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-11-02

FortiGuard Labs publishes research on BITTER's campaign

Research details three infection chains and the use of PapRAT, attributing the activity to BITTER with high confidence.

More articles in this cluster (5)

Threat Graph

19 entities, 44 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Bitter
Bitter APT
TA397

Technique (5)

Malware
T1053 - Scheduled Task/Job
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter
T1071 - Application Layer Protocol

Campaign (1)

PapRAT Cyber Espionage Campaign

Malware (2)

PapRAT
WmRAT

Affected Platform (2)

Windows
WebDAV

Tool (6)

Curl
Ftp.exe
LNK
MSI
PowerShell
RAR

Relationships

Bitter uses PapRAT
Bitter uses WmRAT
Bitter APT uses PapRAT
Bitter APT uses WmRAT
TA397 uses PapRAT
TA397 uses WmRAT
Bitter uses Curl
Bitter uses Ftp.exe
Bitter uses LNK
Bitter uses MSI
Bitter uses PowerShell
Bitter APT uses Curl
Bitter APT uses Ftp.exe
Bitter APT uses LNK
Bitter APT uses MSI
Bitter APT uses PowerShell
TA397 uses Curl
TA397 uses Ftp.exe
TA397 uses LNK
TA397 uses MSI
TA397 uses PowerShell
Bitter uses Malware
Bitter uses T1053 - Scheduled Task/Job
Bitter uses T1059.001 - PowerShell
Bitter uses T1059 - Command and Scripting Interpreter
Bitter uses T1071 - Application Layer Protocol
Bitter APT uses Malware
Bitter APT uses T1053 - Scheduled Task/Job
Bitter APT uses T1059.001 - PowerShell
Bitter APT uses T1059 - Command and Scripting Interpreter
Bitter APT uses T1071 - Application Layer Protocol
TA397 uses Malware
TA397 uses T1053 - Scheduled Task/Job
TA397 uses T1059.001 - PowerShell
TA397 uses T1059 - Command and Scripting Interpreter
TA397 uses T1071 - Application Layer Protocol
PapRAT Cyber Espionage Campaign attributed to Bitter
PapRAT Cyber Espionage Campaign attributed to Bitter APT
PapRAT Cyber Espionage Campaign attributed to TA397
PapRAT Cyber Espionage Campaign uses PapRAT
PapRAT Cyber Espionage Campaign uses WmRAT
Bitter related to Windows
Bitter related to WebDAV
Bitter related to RAR

Following this threat?

Track Bitter and PapRAT in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What organizations are targeted?

The campaign primarily targets South Asian organizations, with some activity noted in Southeast Asia and South Korea.

What are the main methods of infection?

BITTER uses malicious LNK files and Windows Installer packages to deploy PapRAT, often disguising them as legitimate files.

How can we protect against this threat?

Organizations should monitor for unusual behavior in Windows tools and be cautious with LNK files and MSI installers.

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…