BITTER Targets South Asian Organizations With PapRAT and Native Windows Tools
Threat Actor Intelligence · 13 sources · Updated 15h ago · First seen Nov 2, 2026
Fortinet’s FortiGuard Labs attributed a cyberespionage campaign against South Asian government, energy, and engineering organizations to BITTER, also tracked as TA397, with high confidence. The attackers used fake diplomatic documents and three deception-based infection chains involving malicious shortcuts, disk images, archives, and native Windows utilities rather than exploiting software vulnerabilities. Two chains delivered the custom PapRAT remote access trojan through Windows Installer packages; another relied entirely on native Windows utilities, scripts, and scheduled tasks without deploying a traditional malware executable.
PapRAT has C++ and Rust variants capable of executing commands, manipulating files, and capturing screenshots. The newer Rust variant adds commands, switches command-and-control communications from plaintext HTTP to HTTPS, and conceals its command-and-control address through string transformations. One infection chain also deployed WmRAT. Defenders should investigate suspicious installer activity, native-tool execution, scripts, and scheduled tasks alongside PapRAT detections, because removing the trojan alone may leave other attacker access mechanisms intact.
