PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure
In late 2026, FortiGuard Labs attributed a sophisticated cyber espionage campaign to BITTER (TA397), a South Asian threat group active since 2013, targeting government, energy, and engineering organizations across South Asia. The campaign deployed PapRAT, a custom remote access Trojan recently rewritten from C++ to Rust, via three distinct infection chains leveraging legitimate Windows utilities such as ftp.exe, VHDX disk images, and WebDAV-delivered LNK files. PapRAT enables attackers to execute commands, capture screenshots, manipulate files, and download secondary payloads including WmRAT, providing persistent remote control over compromised Windows systems while evading signature-based endpoint detection. This campaign highlights a growing trend of state-linked espionage actors combining native OS living-off-the-land techniques with custom malware written in memory-safe languages like Rust to frustrate traditional defenses. As geopolitical tensions in South Asia intensify, organizations in critical sectors face heightened risk from persistent, evolving threat actors who continuously retool their capabilities to maintain long-term access.
Kill Chain
