Bitter runs PapRAT espionage campaign with three Windows infection chains

On Nov. 2, 2026, FortiGuard Labs published research attributing an espionage campaign against South Asian organizations to Bitter, the India-linked threat group also tracked as TA397, with high confidence.

FortiGuard Labs said its high-confidence assessment rests on lure filenames, patterns in command-and-control traffic, file metadata and malware analysis. The group has been active since at least 2013, with a historical focus on government, energy and engineering targets. Security researchers describe Bitter as one of several India-associated threat actors running tailored campaigns to keep persistent access inside victim networks.

Shield53 Insights said the actor has targeted government, defense, energy and telecommunications organizations in Pakistan, Bangladesh, Sri Lanka and neighboring countries. It also said organizations across South and Central Asia face primary exposure, particularly government bodies, diplomatic missions, defense contractors, critical infrastructure operators and regional non-governmental organizations.

The operation centers on PapRAT, a custom remote access Trojan, and three separate infection chains that misuse legitimate Windows functions to break into systems and retain remote access. With PapRAT, operators can execute commands, browse files, capture screenshots and pull down additional payloads on Windows machines.

The operators rebuilt PapRAT, moving it from C++ to Rust and expanding its command set from eight to eleven. New commands cover PowerShell execution, a sleep directive and clean exit. FortiGuard Labs researchers said Rust appeals to malware developers because of its performance, memory safety and cross-platform support, and that it creates problems for tools designed around traditional malware.

The older C++ build masqueraded as a Microsoft component, sent beacons over plaintext HTTP and supported eight commands covering remote shell access, file transfers and screenshots. The Rust variant moved to HTTPS and added three commands: PowerShell execution, pausing and exiting.

Chain one begins with a malicious Windows shortcut that misuses the built-in ftp.exe program. The shortcut launches scripts and creates scheduled tasks contacting attacker command-and-control servers. In that chain, scheduled tasks rely on curl to fetch fresh commands. FortiGuard Labs found no PapRAT or traditional malware executable in chain one, nothing but shortcuts and other Windows tools along with scripts and scheduled tasks.

FortiGuard Labs said first-chain operators can alter server instructions without distributing a new binary, since scheduled tasks use curl to fetch fresh commands.

Chain two relies on a virtual hard disk image that holds a shortcut displaying a decoy spreadsheet and launching an MSI installer that deploys PapRAT. Chain three opens with an internet shortcut that retrieves an LNK file via WebDAV before launching an MSI installer to install PapRAT. It also delivers PapRAT through an MSI package fetched by an internet shortcut in a RAR archive. In chain three, PapRAT also drops WmRAT, a secondary C++ remote access Trojan that FortiGuard Labs cited as an indicator tying the intrusion to Bitter.

The campaign’s lures included a bilateral meeting request, an envoy’s correspondence about the 11th Belt and Road Summit and a 2026 gala dinner invitation. FortiGuard Labs tracked the campaign for several months, and its telemetry maps show activity in Southeast Asia, South Korea and South Asia.

Deleting PapRAT from infected systems may not cut off attacker access, since scripts and scheduled tasks keep pulling commands, so defenders should look beyond the file that set off the first alert. Sectigo senior fellow Jason Soroko said removing the first implant found may not eliminate the attacker because a PapRAT-limited search could miss parts of the operation. FortiGuard Labs said a full investigation following a PapRAT compromise should check whether attackers accessed sensitive data or credentials or added persistence elsewhere in the network.

Cara Lin of FortiGuard Labs said the PapRAT changes demonstrate continued investment in the group’s tooling. Keeper Security chief information security officer Shane Barney said signature-based defenses offer nothing to alert on when attacks rely on trusted system processes. Shield53 Insights said espionage actors do not need zero-days since features built into the operating system provide similar access at a fraction of the detection risk.

FortiGuard Labs says users should be cautious about unexpected shortcuts, web shortcuts, disk images or installer packages, especially in unsolicited messages, and should use controls that detect suspicious execution chains and outgoing command-and-control traffic. It also recommends reviewing scripting utilities along with job schedulers and installation processes beyond signature-based detection.

Shield53 Insights recommends enabling full PowerShell logging, setting baselines for living-off-the-land binaries, legitimate Windows tools abused by attackers, and reviewing e-mail authentication settings including SPF, DKIM and DMARC. It advises enabling PowerShell Script Block Logging under event ID 4104 and Module Logging under 4103, then sending logs to a SIEM for no fewer than 90 days. Defenders should also create allow-lists or baselines for LOLBins such as mshta, rundll32, wscript, regsvr32, certutil and bitsadmin, with alerts on unexpected parent processes.

Shield53 Insights recommends auditing WMI repository usage, limiting remote WMI access where feasible and watching remote process creation via WMI subscriptions. Hunters should look for spearphishing-related execution artifacts such as .lnk, .iso or .img files alongside macro-enabled documents and suspicious child process spawning. It also recommends testing EDR against living-off-the-land scenarios, checking SPF, DKIM and DMARC enforcement, plus email gateway testing against .iso and .img attachments.

EnterProtect says the Dark Reading report on PapRAT identifies no CVE, product or affected version. It states the report provides no specific countries, sectors or victim names, although it names organizations in South Asia as the targets.

EnterProtect said cyber espionage campaigns bring regulatory and contractual exposure, such as breach notifications, client demands and contract penalties if client data is stolen. It said the campaign raises stakes for clients handling contracts, plans, personnel data or intellectual property, and that lost trust can follow an incident.