Skip to content
NewA calmer, faster ZeroHour
StoryThreat actormedium

BITTER Targets South Asian Organizations with PapRAT

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

FortiGuard Labs links BITTER (TA397) to PapRAT-based espionage against South Asian organizations via three infection chains, including a Rust rebuild with 11 commands.

FortiGuard Labs has tied the India-linked group BITTER, also known as TA397, to a cyber-espionage campaign compromising Windows systems at South Asian organizations. The group uses three infection chains to deliver PapRAT, a remote access Trojan capable of running commands, handling files, capturing screenshots and downloading payloads. BITTER rebuilt PapRAT from C++ to Rust, expanding commands from eight to 11 and mixing it with legitimate Windows tools; one chain employs only native utilities like LNK, ftp.exe and curl to create scheduled tasks, while others use MSI packages.

Key facts
  • BITTER/TA397 active since at least 2013 targeting South Asian government, energy and engineering organizations
  • Three infection chains deliver PapRAT for remote control
  • C++ PapRAT uses 8 commands over plaintext HTTP
  • Rust PapRAT adds PowerShell execution, sleep and exit commands over HTTPS
  • Lures reference bilateral meetings, Belt and Road letter and 2026 gala
  • Activity detected in Southeast Asia and South Korea; one chain fetched WmRAT
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Dark ReadingHistorical targets since 2013 and details on PapRAT rebuild expanding commands
  • Infosecurity MagazineSpecific chain breakdowns including no-malware binary chain, lure details and additional telemetry in Southeast Asia and South Korea
Products
Windows
Threat actors
BITTERTA397Bitter
Malware
PapRATWmRAT
Organizations
FortiGuard LabsFortinet
Countries
IndiaSouth Korea

Coverage

oldest first · one row per article · UTC
  1. · 12h ago Dark ReadingFirst report

    BITTER uses PapRAT in Windows espionage against South Asia

    FortiGuard Labs, with high confidence, describes three infection chains and a Rust rebuild that adds PowerShell, sleep and exit commands.

  2. · 12h ago Infosecurity Magazine

    Bitter deploys PapRAT against South Asian organizations

    FortiGuard Labs, with high confidence, ties three chains to Bitter, including one that uses only Windows tools and no malware binary.