Bitter Espionage Group Hides in Trusted Windows Tools While Deploying New PapRAT Malware

Fortinet's FortiGuard Labs has detailed a cyber-espionage campaign it attributes with high confidence to Bitter, also tracked as TA397. Researcher Cara Lin said the attribution rests on lure filenames, command-and-control patterns, file metadata and malware analysis. The campaign ran for several months and mainly targeted South Asian organizations, though activity also appeared in Southeast Asia and South Korea. Lures included a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.

One attack chain used a living-off-the-land approach. A malicious Windows shortcut file abused the built-in ftp.exe utility to run scripts and create scheduled tasks, which then used curl to fetch fresh commands from attacker servers. No traditional malware executable was deployed, and operators could change instructions without pushing a new binary. Shane Barney of Keeper Security noted that signature-based controls have little to alert on when trusted system processes are abused, and urged least-privilege access, tighter limits on native scripting engines and removal of standing administrative rights.

Two other chains delivered PapRAT through Windows Installer packages, hidden in a virtual hard disk image or fetched through an internet shortcut in a RAR archive. The C++ version posed as a Microsoft component and supported eight commands, including remote shell access, file transfers and screenshots. A newer Rust variant moved to HTTPS and added PowerShell execution, pausing and exiting. In the third chain, PapRAT downloaded WmRAT, another RAT that further links the campaign to Bitter.