Science & Tech · Cybersecurity · 3 hrs ago
Bitter group uses new PapRAT malware in South Asia cyber campaign
The Bitter cyberespionage group has targeted organizations in South Asia with a newly identified malware called PapRAT.
Bitter is also known by several other names and has previously used WmRAT, another malware.
PapRAT can let attackers run commands, manage files, list drives and capture screenshots on infected computers.
The campaign uses three ways to install the malware, involving shortcut files, disk images, scripts and MSI installers.
Some of the scripts collect information about files, drives and security software, then send it to servers controlled by the attackers.
A Rust version adds PowerShell commands and other functions, giving attackers more ways to control infected systems.
The campaign shows that Bitter is refining its tools to gain and keep access to targeted computers.
Organizations are advised to treat unexpected shortcuts, disk images and installers with caution and monitor suspicious scripts and scheduled tasks.
Bitter, a South Asian cyber espionage group, has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT.
The malware has C++ and Rust versions and can execute commands, transfer and delete files, enumerate directories and drives, and capture screenshots.
The campaign uses three infection chains involving shortcut files, a disk image, WebDAV, scripts and MSI installers.
Fortinet said the campaign’s scripts can collect information from infected systems and send it to command-and-control servers.
- Who
- Bitter, also known by several other names, including APT-C-08 and TA397.
- What
- The group used a previously unreported remote access trojan called PapRAT in a cyberespionage campaign.
- When
- The article was published on 2026-11-09. The campaign’s timing is not stated.
- Where
- South Asia; the targeted organizations are not identified.
- Why
- The campaign is described as cyberespionage. A more specific motive is not stated.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Threat group
- Bitter, also known as APT-C-08 and TA397
- Malware
- PapRAT, with C++ and Rust implementations
- Target region
- South Asia
- Infection chains
- Three
- Command-and-control domain
- goodnfortunes[.]com
What people are saying
PapRAT has both C++ and Rust implementations
This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect
These changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures
Organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages