India-Linked Threat Group Targets South Asia with PapRAT Espionage Campaign

A cyber espionage campaign identified as PapRAT is targeting organisations across South Asia, employing techniques designed to evade traditional security detection.

The activity has been attributed to a threat group linked to India. Intelligence indicates that the actors leverage legitimate Windows functionality through three distinct attack chains to conduct their operations.

Living-off-the-land techniques

By utilising built-in system tools and legitimate Windows processes—a tactic frequently referred to as “living-off-the-land”—the PapRAT group can carry out malicious activities while appearing as normal administrative or system operations. This approach makes it significantly more difficult for security software to distinguish between authorised system tasks and unauthorised intrusion.

The use of these three specific attack chains allows the threat actor to maintain persistence and conduct espionage within the targeted organisations while minimising the forensic footprint left behind. Security professionals are advised to monitor for unusual patterns in the use of standard Windows administrative tools and system processes.