GoKawiilFortiGuard Labs ties new PapRAT malware campaign to South Asian group BITTER
FortiGuard Labs researchers report that BITTER (also tracked as TA397), a threat group active since 2013, is using three separate infection chains to deploy a custom remote access Trojan called PapRAT against organizations in South Asia. PapRAT gives attackers control over infected Windows machines, including executing commands, manipulating files, capturing screenshots, and downloading further payloads. Researchers say BITTER recently rewrote PapRAT from C++ to Rust, expanding it from eight to 11 commands and adding PowerShell execution, a sleep function, and a clean-exit command.