GoKawiilFortiGuard Labs ties new PapRAT malware campaign to South Asian group BITTER
FortiGuard Labs researchers report that BITTER (also tracked as TA397), a threat group active since 2013, is using three separate infection chains to deploy a custom remote access Trojan called PapRAT against organizations in South Asia. PapRAT gives attackers control over infected Windows machines, including executing commands, manipulating files, capturing screenshots, and downloading further payloads. Researchers say BITTER recently rewrote PapRAT from C++ to Rust, expanding it from eight to 11 commands and adding PowerShell execution, a sleep function, and a clean-exit command.
GoKawiil's interpretation of the reporting above, not reported fact.
The rewrite in Rust suggests BITTER is investing in evading detection and broadening cross-platform capability, according to FortiGuard Labs researcher Cara Lin, which could make the malware harder for defenders using signature-based tools to catch. The use of native Windows tools alongside custom malware indicates a blended approach that may complicate attribution and detection for targeted organizations in government, energy, and engineering sectors.
- FortiGuard Labs attributes the campaign with high confidence to BITTER, also known as TA397, a group linked to India and active since 2013.
- The campaign uses three infection chains to deploy PapRAT, a custom RAT enabling command execution, file manipulation, screenshots, and payload downloads.
- BITTER rewrote PapRAT from C++ to Rust, increasing its command set from eight to 11 and adding features like PowerShell execution and a clean-exit option.
YubiKey 5 NFC Security Key — With state-sponsored groups like BITTER using custom RATs to gain remote control over Windows systems, strong hardware-based authentication is a practical defense layer for organizations and individuals alike. A YubiKey adds phishing-resistant multi-factor authentication to logins, making it much harder for attackers to pivot even if they compromise a machine. It's a small, durable device that fits right into a broader cybersecurity hygiene strategy.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Elizabeth Montalbano, 2026-11-02
Published there as: “PapRAT Cyber Espionage Campaign Leaves a 'BITTER' Taste in South Asia”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.