Bitter deploys PapRAT against South Asian organizations
Original title: Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign
FortiGuard Labs, with high confidence, ties three chains to Bitter, including one that uses only Windows tools and no malware binary.
FortiGuard Labs says Bitter, also tracked as TA397, used PapRAT and native Windows tools against South Asian organizations over several months. One chain used a malicious LNK and ftp.exe to create scheduled tasks that pulled commands with curl and deployed no malware binary. Two other chains delivered PapRAT through MSI packages; a newer Rust build uses HTTPS and 11 commands, and one chain also fetched WmRAT.
Unconfirmed: FortiGuard attributes the campaign to Bitter with high confidence, not as a confirmed government operation.
- Attribution rests on lure names, C2 patterns, file metadata and malware analysis.
- Lures cited a bilateral meeting, a Belt and Road letter and a 2026 gala.
- Telemetry also showed activity in Southeast Asia and South Korea.
- The C++ PapRAT beacons over plaintext HTTP with eight commands.
- The Rust build adds PowerShell execution, pause and exit.
Impact: remote shell, file access, screenshots and further payloads
- 1.Treat unexpected LNK files, internet shortcuts, disk images and MSI installers with care.
- ATT&CK
- T1204.002 Malicious FileT1053.005 Scheduled TaskT1105 Ingress Tool TransferT1059.001 PowerShellT1218 System Binary Proxy Execution
- Products
- Windows
- Organizations
- FortiGuard LabsFortinet
- Countries
- South Korea
From the original article
2 min read at infosecurity-magazine.com
Bitter used three infection chains against South and Southeast Asian targets, one with no malware executable
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.