BITTER Expands Its Arsenal with PapRAT
Fortinet, Monday, November 2nd, 2026
FortiGuard Labs details a BITTER cyberespionage campaign against South Asian organizations using three attack chains and the PapRAT trojan.
Fortinet attributes the campaign with high confidence to BITTER, a suspected South Asian group active since at least 2013 that targets government, energy and engineering sectors.
One chain uses a malicious LNK file abusing the Windows ftp.exe utility to run scripts and create scheduled tasks.
Another uses a VHDX image that opens a decoy spreadsheet while launching an MSI installer for PapRAT, and a third fetches an LNK file via WebDAV and also delivers the WmRAT implant.
PapRAT exists in C++ and Rust versions and supports command execution, file transfer and deletion, drive enumeration and screenshots.