Bitter APT deploys new PapRAT backdoor in South Asian cyber‑espionage campaign
Security researchers report that the Bitter hacking group is using a new backdoor called PapRAT in cyber‑espionage operations against South Asian targets, delivered through malicious shortcuts and installers. The malware lets attackers run commands, move files and capture screenshots on compromised systems.
A low‑profile espionage group is expanding its toolkit in South Asia. Researchers tracking the Bitter advanced persistent threat group say it has begun using a new backdoor known as PapRAT against organizations in the region.
According to technical reporting, the campaign relies on three infection chains. These include malicious shortcut files and MSI installers that appear legitimate but are designed to launch the malware when users open them. Once installed, PapRAT allows attackers to execute remote commands, transfer files and take screenshots from infected machines.
Those capabilities are suited to long‑term spying rather than quick disruption. Remote command execution lets operators run additional tools and explore internal networks. File transfers give them a way to quietly extract documents and other data. Screenshot capture helps them watch user activity and collect information that might not be stored in obvious files.
Because the lures are built around everyday actions such as opening a document or running an installer, they can be effective even in organizations that have basic defenses in place. A single click on a booby‑trapped shortcut can give attackers a foothold if endpoint protections and user training don’t catch the attempt.
The focus on South Asian targets fits Bitter’s known regional profile and comes at a time of high political tension in that part of the world. Access to internal documents and communications can give outside actors insight into decision‑making and infrastructure planning.
Indicators that will show how far this campaign spreads include the appearance of PapRAT in incident reports beyond the initial victim set, any changes in the malware’s command‑and‑control servers, and public attributions or advisories from governments in the region.
Sources
- OSINT