Threat Intelligence

PapRAT Espionage Campaign Targets South Asian Organisations Using Built-In Windows Features

Dark Reading · 3 Nov 2026

Key Takeaway Monitor for unusual use of normal Windows tools and keep security software and staff awareness training up to date, especially if you work with partners in the region.

Organisations in South Asia are facing a cyber espionage campaign involving a remote access tool called PapRAT. According to Dark Reading, the activity is linked to BITTER, a known threat group associated with India.

The campaign uses three distinct attack chains. A common thread is that the attackers make use of legitimate Windows functionality. This matters because built-in tools and features are trusted by the operating system and can be harder to spot than obviously malicious software.

The summary available does not provide further technical detail, so the full report should be consulted for specifics. The campaign is focused on the South Asia region, but it is a useful reminder for Australian businesses with regional partners, suppliers or operations. Espionage groups often target connected organisations, and the techniques they use can later be applied more widely.

PapRAT BITTER cyber espionage South Asia Windows

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.