Bitter's PapRAT hides in diplomatic lures - ftp.exe LOLBin chains drop C++ and Rust RATs. https://intel.threadlinqs.com/threat/TL-2026-5059?utm_source=bluesky #ThreatIntel #papsolutions #PapRAT #WmRAT
November 2, 2026 at 2:37 PM
Bitter's PapRAT hides in diplomatic lures - ftp.exe LOLBin chains drop C++ and Rust RATs. https://intel.threadlinqs.com/threat/TL-2026-5059?utm_source=bluesky #ThreatIntel #papsolutions #PapRAT #WmRAT
Bitter (TA397) Launches Multi-Stage Cyberattack Campaign Using PapRAT and WmRAT Against South Asian Targets + Video
Introduction: A Sophisticated Espionage Campaign Targets South Asia FortiGuard Labs has attributed a South Asian cyberespionage campaign to the threat actor known as Bitter (TA397)…
Introduction: A Sophisticated Espionage Campaign Targets South Asia FortiGuard Labs has attributed a South Asian cyberespionage campaign to the threat actor known as Bitter (TA397)…
Bitter (TA397) Launches Multi-Stage Cyberattack Campaign Using PapRAT and WmRAT Against South Asian Targets + Video
Introduction: A Sophisticated Espionage Campaign Targets South Asia FortiGuard Labs has attributed a South Asian cyberespionage campaign to the threat actor known as Bitter (TA397) with high confidence. The operation employs three separate Windows infection chains designed to deploy malware families including PapRAT and WmRAT, highlighting the group's continued development of its intrusion capabilities. One particularly notable development is the emergence of a Rust-based version of PapRAT, which introduces additional capabilities and signals an evolution in the group's malware development strategy.
undercodenews.com
November 2, 2026 at 7:20 PM
Bitter (TA397) Launches Multi-Stage Cyberattack Campaign Using PapRAT and WmRAT Against South Asian Targets + Video
Introduction: A Sophisticated Espionage Campaign Targets South Asia FortiGuard Labs has attributed a South Asian cyberespionage campaign to the threat actor known as Bitter (TA397)…
Introduction: A Sophisticated Espionage Campaign Targets South Asia FortiGuard Labs has attributed a South Asian cyberespionage campaign to the threat actor known as Bitter (TA397)…
FortiGuard Labs attributes a South Asian campaign with high confidence to Bitter (TA397). Three Windows infection chains deploy PapRAT, whose Rust version adds capabilities; one chain also delivers WmRAT.
Bitter Uses Three Infection Chains to Deploy PapRAT Across South Asia
FortiGuard Labs attributes a South Asian campaign with high confidence to Bitter (TA397). Three Windows infection chains deploy PapRAT, whose Rust version…
cyber.hendryadrian.com
November 2, 2026 at 6:48 PM
FortiGuard Labs attributes a South Asian campaign with high confidence to Bitter (TA397). Three Windows infection chains deploy PapRAT, whose Rust version adds capabilities; one chain also delivers WmRAT.
Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
BITTER PapRAT Malware Targets South Asian Organizations
At a Glance Malware Family PapRAT malware (C++ and Rust remote access trojans) and WmRAT secondary implant Threat Actor Confirmed campaign attribution to BITTER (also tracked as TA397); suspected South Asian state-aligned cyberespionage group Target / Victims Government, energy, and engineering organizations across South Asia (regional focus confirmed by C2 telemetry and summit lures) Delivery Vector
securityonline.info
November 4, 2026 at 7:10 AM
Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
Bitter APT (APT-C-08, etc.), a suspected Indian state-sponsored group, expands geographically, targeting governments and defense. Uses spear-phishing, malware (WmRAT, MiyaRAT, etc.), and hands-on-keyboard attacks. Active in IST business hours.#BitterAPTExpansion
June 6, 2025 at 4:10 AM
Bitter APT (APT-C-08, etc.), a suspected Indian state-sponsored group, expands geographically, targeting governments and defense. Uses spear-phishing, malware (WmRAT, MiyaRAT, etc.), and hands-on-keyboard attacks. Active in IST business hours.#BitterAPTExpansion
Bitter APT (TA397) attacked a Turkish defense org in Nov 2024 using WmRAT & MiyaRAT. A malicious RAR archive with an LNK & ADS deployed PowerShell, downloading malware from jacknwoods[.]com. This group, active since 2013, is suspected to be state-sponsored (South Asia).#BitterAPTAttack
December 17, 2024 at 12:05 PM
Bitter APT (TA397) attacked a Turkish defense org in Nov 2024 using WmRAT & MiyaRAT. A malicious RAR archive with an LNK & ADS deployed PowerShell, downloading malware from jacknwoods[.]com. This group, active since 2013, is suspected to be state-sponsored (South Asia).#BitterAPTAttack
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
easy4hub.blogspot.com/2024/12/bitt...
#oc #NA #Mayotte #digitalart #WWERAW #christmas #Bayrou
#GH #BookSky #арт
easy4hub.blogspot.com/2024/12/bitt...
#oc #NA #Mayotte #digitalart #WWERAW #christmas #Bayrou
#GH #BookSky #арт
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
Discover how the Bitter APT group targets the Turkish defense sector with WmRAT and MiyaRAT malware in a sophisticated cyber espionage campaign
easy4hub.blogspot.com
December 17, 2024 at 2:36 PM
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
easy4hub.blogspot.com/2024/12/bitt...
#oc #NA #Mayotte #digitalart #WWERAW #christmas #Bayrou
#GH #BookSky #арт
easy4hub.blogspot.com/2024/12/bitt...
#oc #NA #Mayotte #digitalart #WWERAW #christmas #Bayrou
#GH #BookSky #арт
#wmRAT is another #backdoor attributed to the #APT group #TA397, & is used in attacks on organizations in the defense sector across the APAC & EMEA regions. Protect yourself by deploying our public #YARArules: bit.ly/3x34FdW
#Malware #Cybersecurity #SecOps
#Malware #Cybersecurity #SecOps
GitHub - reversinglabs/reversinglabs-yara-rules: ReversingLabs YARA Rules
ReversingLabs YARA Rules. Contribute to reversinglabs/reversinglabs-yara-rules development by creating an account on GitHub.
bit.ly
March 18, 2025 at 2:09 PM
#wmRAT is another #backdoor attributed to the #APT group #TA397, & is used in attacks on organizations in the defense sector across the APAC & EMEA regions. Protect yourself by deploying our public #YARArules: bit.ly/3x34FdW
#Malware #Cybersecurity #SecOps
#Malware #Cybersecurity #SecOps
Bitter Cyber Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/3ZJfY5B
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/3ZJfY5B
Bitter Cyber Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a suspected South Asian cyber espionage group, targeted a Turkish defense organization with WmRAT and MiyaRAT malware. Using sneaky alternate data streams, the attackers disguised their payload as a harmless public infrastructure file, hoping to deliver their malicious software with the grace of a ninja in a library.
buff.ly
December 17, 2024 at 11:40 AM
Bitter Cyber Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/3ZJfY5B
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/3ZJfY5B
Bitter Cyber Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Bitter Cyber Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a suspected South Asian cyber espionage group, targeted a Turkish defense organization with WmRAT and MiyaRAT malware. Using sneaky alternate data streams, the attackers disguised their payload as a harmless public infrastructure file, hoping to deliver their malicious software with the grace of a ninja in a library.
buff.ly
December 17, 2024 at 11:40 AM
Bitter Cyber Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Bitter, a South Asian cyber group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Bitter Potato Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a South Asian potato group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Bitter, a South Asian potato group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
December 17, 2024 at 12:58 PM
Bitter Potato Group Strikes Again: South Asian Espionage Hits Turkish Defense with Sneaky Malware Duo!
Bitter, a South Asian potato group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Bitter, a South Asian potato group, targets Turkish defense with WmRAT and MiyaRAT via sneaky RAR files. Read how they serve malware with a side of stealth.
https://buff.ly/41DzJxT
Proofpoint observed TA397 spear phishing targeting a Turkish defence sector organization. The attack chain used alternate data streams in a RAR to deliver a shortcut (LNK) file that created a scheduled task on the target machine to pull down WmRAT & MiyaRAT. www.proofpoint.com/us/blog/thre...
December 18, 2024 at 11:29 AM
Proofpoint observed TA397 spear phishing targeting a Turkish defence sector organization. The attack chain used alternate data streams in a RAR to deliver a shortcut (LNK) file that created a scheduled task on the target machine to pull down WmRAT & MiyaRAT. www.proofpoint.com/us/blog/thre...
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...
December 17, 2024 at 7:12 PM
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...
📢 Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
https://www.proofpoint.com/us/newsroom/news/bitter-apt-targets-turkish-defense-sector-wmrat-and-miyarat-malware
https://www.proofpoint.com/us/newsroom/news/bitter-apt-targets-turkish-defense-sector-wmrat-and-miyarat-malware
December 21, 2024 at 1:22 AM
📢 Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
https://www.proofpoint.com/us/newsroom/news/bitter-apt-targets-turkish-defense-sector-wmrat-and-miyarat-malware
https://www.proofpoint.com/us/newsroom/news/bitter-apt-targets-turkish-defense-sector-wmrat-and-miyarat-malware
📰 Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html
https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html
December 17, 2024 at 11:17 AM
📰 Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html
https://thehackernews.com/2024/12/bitter-apt-targets-turkish-defense.html
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware reconbee.com/bitter-apt-t...
#BitterAPT #APT #Turkish #WmRAT #MiyaRAT #malware #malwareattack #malware
#BitterAPT #APT #Turkish #WmRAT #MiyaRAT #malware #malwareattack #malware
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
The hacking group's previous efforts have targeted read more about Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
reconbee.com
December 18, 2024 at 3:11 AM
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware reconbee.com/bitter-apt-t...
#BitterAPT #APT #Turkish #WmRAT #MiyaRAT #malware #malwareattack #malware
#BitterAPT #APT #Turkish #WmRAT #MiyaRAT #malware #malwareattack #malware
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware thehackernews.com/2024/12/bitt...
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
South Asian APT group Bitter targets Turkish defense sector with WmRAT and MiyaRAT malware via NTFS ADS and scheduled tasks.
thehackernews.com
December 17, 2024 at 12:02 PM
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware thehackernews.com/2024/12/bitt...
In the final stages of this attack chain, TA397 was observed manually delivering WmRAT and MiyaRAT malware families. Both malware families are designed to enable intelligence gathering and exfiltration.
December 17, 2024 at 6:00 PM
In the final stages of this attack chain, TA397 was observed manually delivering WmRAT and MiyaRAT malware families. Both malware families are designed to enable intelligence gathering and exfiltration.
~Eclecticiq~
Bitter APT spear-phished Pakistan Telecom (PTCL) with WmRAT for espionage during regional conflict.
-
IOCs: tradesmarkets. greenadelhouse. com, 185. 244. 151. 87, fogomyart. com
-
#BitterAPT #Espionage #ThreatIntel #WmRAT
Bitter APT spear-phished Pakistan Telecom (PTCL) with WmRAT for espionage during regional conflict.
-
IOCs: tradesmarkets. greenadelhouse. com, 185. 244. 151. 87, fogomyart. com
-
#BitterAPT #Espionage #ThreatIntel #WmRAT
Bitter APT Targets PTCL Amid Conflict
blog.eclecticiq.com
May 28, 2025 at 8:13 PM
~Eclecticiq~
Bitter APT spear-phished Pakistan Telecom (PTCL) with WmRAT for espionage during regional conflict.
-
IOCs: tradesmarkets. greenadelhouse. com, 185. 244. 151. 87, fogomyart. com
-
#BitterAPT #Espionage #ThreatIntel #WmRAT
Bitter APT spear-phished Pakistan Telecom (PTCL) with WmRAT for espionage during regional conflict.
-
IOCs: tradesmarkets. greenadelhouse. com, 185. 244. 151. 87, fogomyart. com
-
#BitterAPT #Espionage #ThreatIntel #WmRAT
Unveiling TA397: A sophisticated malware targeting the Turkish defense sector. 🚨💻 Stay informed on the latest cybersecurity threats! 🔍 Read more: https://innovirtuoso.com/cybersecurity/unveiling-ta397-the-sophisticated-malware-targeting-the-turkish-defense-sector #Cybersecurity #Malware #TA397
TA397: Malware Targeting the Turkish Defense Sector
The TA397 phishing campaign poses a significant threat to the Turkish defense sector, techniques such as phishing and advanced malware like WMrat and Miyarat.
innovirtuoso.com
May 18, 2025 at 6:15 PM
Unveiling TA397: A sophisticated malware targeting the Turkish defense sector. 🚨💻 Stay informed on the latest cybersecurity threats! 🔍 Read more: https://innovirtuoso.com/cybersecurity/unveiling-ta397-the-sophisticated-malware-targeting-the-turkish-defense-sector #Cybersecurity #Malware #TA397
The #TA397 campaign targets 🇹🇷 defense, using phishing & advanced malware like WMrat & Miyarat. Stay alert to these evolving threats! 🛡️🕵️♂️ Cybersecurity #Phishing #Malware
Read more at: innovirtuoso.com/cybersecurit...
Read more at: innovirtuoso.com/cybersecurit...
TA397: Malware Targeting the Turkish Defense Sector
The TA397 phishing campaign poses a significant threat to the Turkish defense sector, techniques such as phishing and advanced malware like WMrat and Miyarat.
innovirtuoso.com
December 18, 2024 at 3:26 PM
The #TA397 campaign targets 🇹🇷 defense, using phishing & advanced malware like WMrat & Miyarat. Stay alert to these evolving threats! 🛡️🕵️♂️ Cybersecurity #Phishing #Malware
Read more at: innovirtuoso.com/cybersecurit...
Read more at: innovirtuoso.com/cybersecurit...
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
#thehackersnews
#thehackersnews
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
South Asian APT group Bitter targets Turkish defense sector with WmRAT and MiyaRAT malware via NTFS ADS and scheduled tasks.
thehackernews.com
December 17, 2024 at 12:00 PM
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
#thehackersnews
#thehackersnews