Bitter Cyber-Espionage Group Uses PapRAT Against Asian Targets

A suspected South Asian cyber-espionage group, known as Bitter, has been observed utilizing a combination of native Windows tools and a custom remote access trojan (RAT) named PapRAT to infiltrate targeted organizations. Research published by Cara Lin of Fortinet's FortiGuard Labs on November 2 attributes this campaign with high confidence to Bitter, also referred to as TA397. This attribution is based on various indicators, including lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis.

FortiGuard Labs has tracked this campaign over several months, identifying South Asian organizations as primary targets, although telemetry data also indicates activity in Southeast Asia and South Korea. The lure files used in this campaign included references to a bilateral meeting request, an ambassador's letter regarding the 11th Belt and Road Summit, and an invitation to a gala dinner in 2026.

The first infection chain employed a living-off-the-land strategy, utilizing a malicious Windows shortcut (LNK) file that exploited the built-in ftp.exe utility to execute scripts and create scheduled tasks. These tasks were designed to fetch commands from attacker servers using curl, and notably, this chain did not deploy any traditional malware executable. According to FortiGuard Labs, this approach allows operators to modify their instructions on the server without the need to push a new binary.

Shane Barney, CISO at Keeper Security, emphasized that when an intrusion leverages trusted system processes, traditional signature-based controls may fail to provide alerts. He advocated for implementing least-privilege access, imposing stricter limits on native scripting engines, and eliminating standing administrative rights to enhance security.

Methods of PapRAT Infection Unveiled

The other two infection chains delivered PapRAT through Windows Installer (MSI) packages. One of these chains concealed the RAT within a decoy spreadsheet located in a virtual hard disk (VHDX) image, while the other was retrieved via an internet shortcut contained in a RAR archive. The C++ version of PapRAT masquerades as a Microsoft component, communicates over plaintext HTTP, and supports multiple commands, including remote shell access, file transfers, and screenshots. A more recent Rust variant has transitioned to HTTPS and introduced additional commands for PowerShell execution, pausing, and exiting.

Approved for Dissemination

In a notable aspect of the third infection chain, PapRAT was found to download WmRAT, a C++ RAT previously documented by other researchers, further linking this campaign to Bitter. Jason Soroko, a senior fellow at Sectigo, cautioned that relying solely on searching for PapRAT could overlook parts of the broader campaign, as simply removing the first implant might not eliminate the attacker.

FortiGuard Labs recommended exercising caution when handling unexpected LNK files, internet shortcuts, disk images, and MSI installers to mitigate risks associated with these types of attacks. Interestingly, in the first infection chain, FortiGuard found no evidence of PapRAT itself, only the shortcut file, Windows tools, scripts, and scheduled tasks, highlighting the complexity of detection in such cyber-espionage operations.