Bitter deploys PapRAT against South Asian organizations
November 9: The Hacker News adds Bitter aliases, Rust commands MS2, SLP, and BYE, reconnaissance saved as abc.pdf, and a techtalkhelp.com script stage.
Fortinet says Bitter is installing PapRAT, and sometimes WmRAT, on South Asian Windows systems through fake invitations.
Fortinet FortiGuard Labs says the South Asian espionage group Bitter is targeting government, energy, and engineering organizations with PapRAT, a previously unreported remote access trojan. Three chains use malicious LNK shortcuts that abuse ftp.exe and scheduled tasks, VHDX images with Excel lures and MSI installers, or WebDAV shortcuts, sometimes inside RAR archives disguised as diplomatic invitations. PapRAT has C++ and Rust builds and can run commands, transfer and delete files, list drives, and take screenshots; the Rust build also runs PowerShell. One chain later drops WmRAT, which beacons over HTTP or HTTPS. Cyber Security News says Bitter has been active since at least 2013. No victim count or patch is reported.
- Targets government, energy, and engineering organizations in South Asia.
- Chains use LNK files with ftp.exe, VHDX plus MSI, and WebDAV shortcuts.
- PapRAT is written in C++ and Rust; Rust adds PowerShell execution.
- The Rust build adds MS2, SLP, and BYE commands, according to The Hacker News.
- One infection chain later drops WmRAT after PapRAT.
- Aliases include APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397.
What each outlet adds
beyond the shared facts- GBHackersNames lure files, Type 194 MSI CustomAction, requpap.pdb, and update-like tasks.
- Cyber Security NewsDates Bitter activity to at least 2013 and notes a 42-second HTTPS wait.
- The Hacker NewsLists aliases, abc.pdf recon, techtalkhelp.com staging, and Rust commands.
- Vendors
- Fortinet
- Products
- Windows
- Organizations
- Fortinet
- Countries
- South Asia
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
BITTER Delivers PapRAT via Fake Diplomatic Invitations
The BITTER group uses custom RAT PapRAT and WmRAT in lures targeting South Asian organizations.
- · 6d ago
Cyber Security News
BITTER uses malicious VHDX files and WebDAV to deliver PapRAT
BITTER deploys PapRAT RAT via VHDX files and WebDAV links targeting South Asian organizations since at least 2013.
- · 2h ago
The Hacker News
Bitter deploys PapRAT backdoor against South Asian organizations
Fortinet describes C++ and Rust PapRAT builds delivered through LNK, VHDX, and WebDAV chains, with one chain also dropping WmRAT.