Threat Intelligence

Bitter Espionage Group Adds New PapRAT Backdoor to Its Toolkit in South Asia Campaign

The Hacker News · 10 Nov 2026

Key Takeaway Monitor for unusual use of built-in tools such as PowerShell and curl, and restrict unexpected MSI installations, since attackers like Bitter use them to avoid traditional malware detection.

Researchers at Fortinet FortiGuard Labs report that the Bitter group (also tracked as APT-C-08, Hazy Tiger and TA397) has been targeting South Asian organisations with a new remote access trojan named PapRAT. It exists in both C++ and Rust versions. Its capabilities include running commands, uploading and downloading files, deleting files, listing directories and drives, and capturing screenshots. The Rust version adds PowerShell execution and other commands.

The campaign uses three infection chains. The first relies on built-in system tools to take commands from a remote server. It gathers directory and task lists, folder details from Desktop, Documents and Downloads, installed antivirus information and mounted drives. This data is saved as a file, sent to the attacker with curl, then deleted from the device. A second chain delivers PapRAT through an MSI installer, and a script variant fetches a file that holds an encoded script with further instructions to run as PowerShell. Fortinet noted that updating commands on the server avoids dropping new binaries or injecting into processes, which some security appliances detect easily.

The third chain combines the first two. A script uses curl to download an MSI installer, which installs PapRAT, and PapRAT then drops WmRAT, a malware previously linked to Bitter. Fortinet's findings suggest the group keeps refining its custom tools to gain and keep access to targeted systems.

Bitter APT PapRAT Remote Access Trojan Cyber Espionage Living off the Land

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.