Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
Summary: The South Asian espionage group Bitter, tracked under aliases including APT-C-08 and TA397, has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT, which exists in C++ and Rust implementations and supports command execution, file upload and download, file deletion, directory and drive enumeration, and screenshot capture. Fortinet FortiGuard Labs researcher Cara Lin described three infection chains, including a living-off-the-land script that collects directory and task lists, Desktop, Documents and Downloads contents, installed antivirus data and mounted drives, saves it as "abc.pdf" and exfiltrates it via curl to "goodnfortunes[.]com", and an MSI installer chain that drops PapRAT and then WmRAT.
What you should know: The staging model lets Bitter update commands server-side without pushing a new binary, avoiding the PE drops and process injection that some security appliances are built to catch. Fortinet's guidance is to watch scripting tools, scheduled tasks and installer activity alongside signatures, and to treat unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, particularly when delivered through unsolicited messages.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026