BITTER uses PapRAT in Windows espionage against South Asia
Original title: PapRAT Cyber Espionage Campaign Leaves a 'BITTER' Taste in South Asia
FortiGuard Labs, with high confidence, describes three infection chains and a Rust rebuild that adds PowerShell, sleep and exit commands.
FortiGuard Labs says the India-linked group BITTER, also known as TA397, is compromising Windows systems at South Asian organizations to keep remote control. PapRAT can run commands, handle files, capture screenshots and download further payloads. The group rebuilt the Trojan from C++ to Rust, expanding it from eight commands to 11, and mixes it with legitimate Windows functions across three chains.
Unconfirmed: The India link and high-confidence attribution come from FortiGuard Labs, not an official government finding.
- BITTER has been active since at least 2013.
- Historical targets include government, energy and engineering organizations.
- PapRAT moved from C++ to Rust and from eight commands to 11.
- New commands cover PowerShell execution, sleep and a clean exit.
Impact: remote command execution, file control and screenshots
- Products
- Windows
- Malware
- PapRAT
- Organizations
- FortiGuard Labs
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 142a2e80d6a5fef7c9df2e421245edcb | ing-fortune-500-brands#recipe=similar-items&sourcecontentid=142a2e80d6a5fef7c9df2e421245edcb) Operation DoppelBrand: Weaponizing Fortune 500 Brands by |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
7 min read at darkreading.com
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.