PapRAT is a Windows remote access trojan tied to the BITTER group. See how it arrives, what it can do, the traces it leaves and how to clean a PC.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

Organizations in the region face growing cyberattacks from the known threat group, which leverages legitimate OS functionality in 3 distinct attack chains.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

Bitter used three infection chains against South and Southeast Asian targets, one with no malware executable

At a Glance Malware Family PapRAT malware (C++ and Rust remote access trojans) and WmRAT secondary implant Threat Actor Confirmed campaign attribution to BITTER (also tracked as TA397); suspected South Asian state-aligned cyberespionage group Target / Victims Government, energy, and engineering organizations across South Asia (regional focus confirmed by C2 telemetry and summit lures) Delivery Vector

FortiGuard Labs says the suspected South Asian group BITTER used three Windows infection chains to deploy PapRAT and maintain access to targeted organizations.

    BITTER Expands Its Arsenal with PapRAT 0 views Skip to first unread message Eyal Estrin unread, 7:07 AM (14 minutes ago)    to https://www.fortinet.com/blog/threat-research/bitter-expands-its-arsenal-with-paprat Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

The PapRAT cyber espionage campaign is targeting organizations in South Asia.

BITTER hackers target South Asian organizations with fake invitations that secretly install PapRAT malware for espionage.

FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware.

FortiGuard Labs attributes a South Asian campaign with high confidence to Bitter (TA397). Three Windows infection chains deploy PapRAT, whose Rust version…

Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.

Organizations in the region face attacks from the known threat group, which leverages legitimate OS functionality in three distinct attack chains.

Cet article de recherche sur les menaces documente une campagne active attribuée avec haute confiance au groupe BITTER, un acteur de cyberespionnage suspecté d'origine sud-asiatique, actif depuis au moins 2013 et ciblant historiquement les secteurs gouvernemental, énergétique et de l'ingénierie.

Introduction: A Sophisticated Espionage Campaign Targets South Asia FortiGuard Labs has attributed a South Asian cyberespionage campaign to the threat actor known as Bitter (TA397) with high confidence. The operation employs three separate Windows infection chains designed to deploy malware families including PapRAT and WmRAT, highlighting the group's continued development of its intrusion capabilities. One particularly notable development is the emergence of a Rust-based version of PapRAT, which introduces additional capabilities and signals an evolution in the group's malware development strategy.