Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia Ravie LakshmananNov 09, 2026Cyber Espionage / Threat Intelligence The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands." The campaign is notable for making use of three different infection chains - A Windows Shortcut (LNK) file that abuses the native "ftp.exe" utility to run scripts and create scheduled tasks designed to maintain contact with a command-and-control (C2) server. A VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet, while running an MSI installer in the background to deploy PapRAT. A URL shortcut (URL) file that fetches a LNK file via WebDAV, which then leads to an MSI installer that deploys PapRAT. The living-off-the-land (LotL) approach is designed to execute commands from a remote server ("goodnfortunes[.]com"), allowing it to collect directory and task lists, directory information from Desktop, Documents, and Downloads, installed antivirus product data, and mounted drives. The harvested reconnaissance information is saved as "abc.pdf" and exfiltrated back to the C2 server via a curl command, after which the staged file is deleted from the host. A second version of the script has been found to retrieve a file called "talk.log" from "techtalkhelp[.]com." The payload contains a Base64-encoded script to obtain additional instructions from the same server and execute them as PowerShell commands. "This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect," Fortinet said. The PapRAT malware delivered via the MSI installer in the second attack chain is designed for remote control. It supports eight commands - UPP, for uploading local files to the C2 server ("rivingtonclarks[.]com") DWW, for downloading files from the C2 server A Rust version of the malware incorporates three more commands - A notable aspect of the third attack chain is that it combines the salient aspects of the first two sequences by using a script to download an MSI installer via curl. Like before, the MSI installer serves as a conduit for PapRAT, which then proceeds to drop WmRAT, a malware previously identified as used by Bitter. The findings indicate that the threat actor continues to refine its custom arsenal to establish and maintain access to targeted systems. "These changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures," Fortinet said. "Organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, cyber espionage, Malware, Threat Intelligence OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Flood is Coming And The Pipes Were Already Full Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk