Fortinet details BITTER’s expanding PapRAT attacks in South Asia

Fortinet’s FortiGuard Labs researchers report that the India-linked cyber espionage group BITTER (also known as TA397) is targeting organisations across South Asia with attacks designed to compromise Windows systems, establish persistence, and grant remote control over infected hosts. The campaign centres on PapRAT, a bespoke remote access Trojan that enables attackers to execute commands, manipulate files, capture screenshots, and download additional payloads. The findings, published on 2 November 2026, describe three distinct infection chains that show BITTER expanding PapRAT’s capabilities.

BITTER has refreshed PapRAT from a C++ base to Rust, increasing its functionality from eight to 11 commands and adding PowerShell execution, a sleep directive, and a clean-exit option. The researchers note this indicates ongoing investment in the toolset and a broader malware footprint.

The three attack chains each abuse legitimate Windows functionality to blend in with normal system activity: a malicious LNK file using ftp.exe to run scripts and create scheduled tasks; a VHDX disk image containing an LNK that opens a decoy Excel sheet while silently deploying an MSI to install PapRAT; and a URL shortcut that retrieves an LNK via WebDAV leading to an MSI install that deploys PapRAT, with PapRAT also delivering WmRAT in this chain.

FortiGuard Labs emphasises co-opting trusted processes to evade signature-based detection, while researchers from Keeper Security and Sectigo highlight the need for strict privilege boundaries, monitoring of suspicious scripting and installer activity, and deeper post-infection recovery to identify additional payloads and persistence mechanisms.