Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
Bitter APT deploys new PapRAT backdoor targeting South Asian organizations in cyberespionage campaign.
The Bitter threat group, also tracked as APT-C-08, APT-Q-37, and several other aliases, has launched a new cyberespionage campaign against South Asian targets using a previously unknown remote access trojan called PapRAT. The malware features both C++ and Rust implementations and includes capabilities for command execution and file operations. Fortinet FortiGuard Labs researchers documented the campaign, highlighting the group's continued focus on regional espionage activities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Bitter threat group has introduced PapRAT, a previously unknown remote access trojan with both C++ and Rust implementations, targeting South Asian organizations in a cyberespionage campaign. The use of a novel, dual-implementation RAT suggests deliberate efforts to evade signature-based detection tools that rely on known malware patterns. Once deployed, PapRAT enables attackers to execute commands and perform file operations, giving them persistent, stealthy access to compromised systems. This campaign underscores how advanced persistent threat actors continuously innovate their tooling to stay ahead of defenders, making behavioral detection and user awareness critical lines of defense.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — PapRAT