Threats · 3h ago
FortiGuard Labs attributes a campaign against South and Southeast Asian organizations to BITTER (TA397) with high confidence, documenting three Windows infection chains, one of which deploys no malware executable. The other two deliver PapRAT, a remote access Trojan; its newer Rust version adds commands and switches communications to HTTPS.
The executable-free chain starts with a malicious Windows shortcut that uses built-in ftp.exe to run scripts and create scheduled tasks. Those tasks use curl to fetch instructions from an attacker-controlled server. Because operators can change the instructions there, they can change what an infected host does without sending a new malware file.
If your Windows estate is among BITTER’s regional targets, a hunt focused on PapRAT binaries can miss one chain entirely. The server-side changes also mean a search for a known payload may not capture later activity through trusted Windows utilities and scheduled tasks.
2 sources covering this story
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign
Bitter used three infection chains against South and Southeast Asian targets, one with no malware executable
PapRAT Cyber Espionage Campaign Leaves BITTER Taste in South Asia
Organizations in the region face attacks from the known threat group, which leverages legitimate OS functionality in three distinct attack chains.
Part of the PlainSec briefing for 2026-11-02