Bitter Threat Actor Uses PapRAT in Asian Cyber-Espionage Campaign

Researchers at FortiGuard Labs have identified a targeted cyber-espionage campaign attributed to a suspected South Asian threat actor known as Bitter, also tracked as TA397. The group is using a custom remote access trojan (RAT) named PapRAT alongside native Windows tools to maintain access to organisations across South Asia, Southeast Asia, and South Korea.

The campaign employs diverse infection vectors, including a “living-off-the-land” approach that avoids deploying traditional malware binaries. In one observed chain, attackers used a malicious Windows shortcut (LNK) file to abuse the built-in ftp.exe utility. This allowed them to run scripts and create scheduled tasks that used curl to fetch commands from attacker-controlled servers.

Evolution of PapRAT Malware

FortiGuard Labs noted that PapRAT has undergone technical shifts to increase its effectiveness and stealth. An earlier C++ build of the malware posed as a legitimate Microsoft component and communicated via plaintext HTTP. It featured eight commands, including remote shell access, file transfers, and screenshot capabilities.

A more recent Rust-based variant has transitioned to using HTTPS for communication. This version also introduced additional capabilities, such as the ability to execute PowerShell commands and instructions to pause or exit the process.

In a separate infection chain, the group deployed PapRAT through Windows Installer (MSI) packages. One method involved hiding the payload within a decoy spreadsheet inside a virtual hard disk (VHDX) image, while another used an internet shortcut contained within a RAR archive. In some instances, the group also deployed WmRAT, a C++ RAT previously identified in other campaigns.

Lures and Targeting Tactics

The espionage efforts appear to be driven by specific geopolitical interests. Attackers used social engineering lures related to official diplomatic and international events, including requests for bilateral meetings, letters regarding the 11th Belt and Road Summit, and invitations to a 2026 gala dinner.

Because some of the attack chains rely entirely on trusted system processes and scripts, security experts warn that traditional signature-based controls may fail to detect the intrusion. Shane Barney, CISO at Keeper Security, noted that when attackers leverage native utilities, signature-based tools often have nothing to alert on.

To mitigate these risks, security researchers recommend implementing least-privilege access, placing tighter limits on native scripting engines, and removing standing administrative rights. Organisations are also advised to exercise extreme caution when handling unexpected LNK files, internet shortcuts, disk images, and MSI installers.