Bitter deploys PapRAT backdoor against South Asian organizations

Bitter, the espionage group tracked as APT-C-08 and TA397, is deploying a previously undocumented remote access trojan called PapRAT against South Asian organizations.

FortiGuard Labs attributed the campaign to Bitter with high confidence, basing the judgment on lure filenames, command-and-control patterns, file metadata and malware analysis. Researchers at the lab followed the campaign for months, an observation window for the campaign.

Bitter has operated since at least 2013 and historically focused on government, energy and engineering targets. Mitre tracks the suspected South Asian espionage group as G1002, also known as T-APT-17.

Proofpoint and Threatray released joint research in September 2025 saying Bitter is highly likely a state-backed group acting for the Indian government, with Proofpoint tracking the group as TA397 based on campaigns observed between October 2024 and April 2025. Proofpoint recorded targets outside Asia, including European organizations with interests or a presence in China, Pakistan and nearby countries. Attackers pretended to be government and diplomatic entities from Madagascar and Mauritius to make spear-phishing approaches more believable.

PapRAT exists in both C++ and Rust implementations, Cara Lin of Fortinet FortiGuard Labs said. The C++ implementation handles eight commands and the Rust implementation handles 11 commands. The Rust version adds PowerShell execution, pausing and resuming polling, and process termination to the C++ command set, additions that show expanded functionality in the newer variant. PapRAT lets attackers run commands, move and remove files, view directories and drives, and take screenshots, which Fortinet researchers described as the trojan’s core capabilities.

The Rust build connects to its command server using HTTPS, while the C++ build contacts its command server through unencrypted HTTP, a contrast in network behavior between the two implementations. Build artifacts show the product name papsolutions and the PDB file requpap.pdb, identifiers researchers use to identify PapRAT. The C++ sample’s command-and-control configuration is XOR-encoded with key 0x50, and the Rust version conceals its command-and-control address by reversing and ROT-3-shifting strings in its.rdata section. PapRAT uploads files to rivingtonclarks[.]com using the UPP command.

Researchers observed three distinct infection chains involving Windows shortcuts, disk images and MSI installers, delivery mechanisms they described as central to the campaign. The first chain uses a malicious shortcut that misuses ftp.exe to execute scripts and build scheduled tasks for command-and-control contact. This first chain deploys no traditional malware executable and relies on living-off-the-land techniques, which abuse trusted system tools already on a machine.

Because it abuses trusted system tools, signature-based controls have nothing to flag, Shane Barney, chief information security officer at Keeper Security, said. The first chain collects directory and task lists, folder information from Desktop, Documents and Downloads, antivirus product data and mounted drives. The first chain stores collected reconnaissance data as abc.pdf and sends it to the command server using curl, then removes the staged file. The staging model lets attackers change commands on the server without sending a new binary, avoiding portable executable drops and process injection.

The second chain uses a disk image containing a shortcut that starts a decoy spreadsheet and runs an MSI installer to deploy PapRAT. The third chain starts with a URL shortcut that retrieves another shortcut through WebDAV, leading to an MSI package that installs PapRAT. In the third chain, PapRAT also drops WmRAT, a separate backdoor previously documented by other researchers, a link that ties the new backdoor to previously documented Bitter tooling. WmRAT reaches out to netmansrvdns.com to receive additional commands during the third chain.

A second script version retrieves talk.log from techtalkhelp[.]com and contains Base64-encoded instructions executed as PowerShell commands, a secondary script behavior observed in the campaign. The adversary uses the native Windows schtasks.exe utility with a deceptive task name, MicrosoftUpdatesupdates11678, to execute payloads every 30 minutes. Lure files mentioned a bilateral meeting request, an envoy’s letter regarding the 11th Belt and Road Summit and a 2026 gala dinner invitation. Researchers saw activity in Southeast Asia and South Korea in addition to South Asian targets.

Companies should handle surprising shortcut files, web shortcuts, disk images and installer packages carefully, especially when they arrive in unrequested messages. Fortinet recommended watching for harmful activity in scripting tools, scheduled tasks and installer activity together with known malware signatures. Jason Soroko, a Sectigo senior fellow, said looking only for PapRAT could overlook part of the operation.

Defenders should examine scheduled tasks and MSI installer logs for unauthorized changes and run forensic analysis on artifacts such as err.log or talk.log. When defenders detect malicious activity, they should isolate compromised hosts to prevent lateral movement and further command execution. SOC Prime provided the forensic and incident-response guidance.