PapRAT

Bitter APT Group Deploys PapRAT Backdoor in South Asia Cyberespionage Campaign

The South Asian cyber espionage group known as Bitter has been observed deploying a previously unreported remote access trojan called PapRAT against organizations in the region. PapRAT exists in both C++ and Rust variants, offering capabilities such as command execution, file operations, directory enumeration, screenshot capture, and PowerShell execution in the Rust version. The campaign employs three distinct infection chains involving LNK files, VHDX disk images, and URL shortcuts that abuse native Windows utilities like ftp.exe and WebDAV to maintain persistence via scheduled tasks. Reconnaissance data is collected and exfiltrated using living-off-the-land techniques before the staged files are deleted. The MSI-delivered PapRAT supports multiple commands for remote control and drops the previously known WmRAT malware in one chain. Fortinet FortiGuard Labs researcher Cara Lin noted that the server-side command updates provide operational flexibility while avoiding detectable process injection. Organizations are advised to treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution.