Threats · 3 days ago
Fortinet FortiGuard Labs reported that Bitter is using the previously unreported PapRAT backdoor against South Asian organizations, with three infection chains and C++ and Rust variants. The routes begin with a Windows shortcut that uses ftp.exe, a virtual disk image that runs an installer behind an Excel lure, or a URL shortcut that fetches a file through Web-based Distributed Authoring and Versioning (WebDAV).
The staging scripts contact attacker-controlled servers for instructions, which can change without a new malware binary being sent. PapRAT can execute commands and move or delete files; the Rust variant adds PowerShell execution. That split matters: a hunt keyed to one lure or a known PapRAT file can miss another delivery path or later script activity.
For organizations with South Asian operations, especially those handling strategically sensitive work, defenses centered on one attachment or binary leave other routes and server-driven behavior outside view. Fortinet’s reporting does not establish a broader victim scope.
1 source covering this story
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
Bitter targets South Asian organizations with new PapRAT malware, using three infection chains and C++ and Rust variants for remote access.
Part of the PlainSec briefing for 2026-11-10