PapRAT Malware Targets South Asian Organizations in BITTER Campaign

FortiGuard Labs has linked a cyber-espionage campaign targeting South Asian organizations to BITTER, a suspected South Asian threat group, and documented its use of a custom remote-access trojan called PapRAT. The research published November 2 describes three infection chains that combine malicious shortcuts, Windows utilities, disk images and installer packages to establish persistent access.

One chain abuses Windows’ built-in ftp.exe to run scripts and create scheduled tasks, without dropping a traditional malware executable during that stage. Another hides an MSI installer inside a VHDX disk image alongside a decoy spreadsheet, while a third retrieves a shortcut over WebDAV before launching an installer. In the latter chain, PapRAT also delivers WmRAT, a second remote-access implant.

FortiGuard says PapRAT supports remote command execution, file transfers and deletion, directory and drive enumeration, and screenshot capture. It has C++ and Rust variants; the newer Rust version adds PowerShell execution and other commands, expanding its command set from eight to 11. Researchers attributed the activity to BITTER with high confidence based on lure filenames, command-and-control patterns, file metadata and malware analysis.

BITTER has been active since at least 2013 and has historically targeted government, energy and engineering organizations. Earlier reporting linked the group to a hack-for-hire campaign targeting journalists and officials through iCloud and Signal attacks.

❤️

If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.

Support Us