FortiGuard links PapRAT espionage campaign to Bitter in Asia

A South Asian cyber-espionage group, tracked as Bitter (TA397) and observed by FortiGuard Labs, has been seen deploying a custom remote access Trojan named PapRAT alongside native Windows tools to maintain access to targeted organisations. FortiGuard’s analysis, published on 2 November 2026, links the activity to Bitter based on lure filenames, command-and-control patterns, file metadata and malware analysis.

The operation appears to have spanned several months with targets mainly in South Asia, though FortiGuard’s telemetry also shows activity in Southeast Asia and South Korea. Lure files include a bilateral meeting request, an ambassador’s letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.

PapRAT campaigns are described as comprising three infection chains, one of which operates without a malware binary. The first chain uses a malicious Windows shortcut (LNK) that abuses ftp.exe to run scripts and create scheduled tasks, with curl fetching new commands from attacker servers; FortiGuard notes that these “living-off-the-land” techniques can evade signature-based detection.

The other two chains deliver PapRAT via Windows Installer (MSI) packages—one hidden inside a decoy spreadsheet in a VHDX image, the other delivered through an internet shortcut in a RAR archive. PapRAT itself has a C++ build that masquerades as a Microsoft component, beaconing over plaintext HTTP and supporting eight commands (including remote shell, file transfer and screenshots); a Rust variant later added HTTPS and three further commands for PowerShell execution, pausing and exiting.

In the third chain, PapRAT downloads WmRAT, a previously documented C++ RAT. FortiGuard’s guidance emphasises caution with unexpected LNK files, internet shortcuts, disk images and MSI installers, noting that one chain showed no PapRAT presence at all, only Windows tools and scheduled tasks.