A South Asian cyber espionage group known as BITTER is targeting regional organizations with sophisticated attacks designed to compromise Windows systems and establish long-term remote access, according to Dark Reading.
Research from FortiGuard Labs attributes these campaigns to the group, also known as TA397, which has been active since 2013. The attackers are utilizing a custom remote access Trojan called PapRAT, which has recently been rewritten in Rust. This transition has expanded the malware's capabilities to 11 commands, including PowerShell execution and file manipulation. The group employs three distinct infection chains that abuse legitimate Windows utilities, such as ftp.exe and MSI installers, to evade traditional security detection.
By leveraging these trusted system processes, the attackers maintain persistence and command-and-control communication while remaining hidden from signature-based tools. Industry experts emphasize that these hybrid tactics require organizations to move beyond simple endpoint protection. Defenders are urged to implement strict privilege boundaries, monitor suspicious execution chains, and remain vigilant against unsolicited LNK files or disk images. Because PapRAT can deploy secondary implants like WmRAT, security teams must conduct thorough investigations to ensure all persistence mechanisms are removed during incident response efforts.
Source: Dark Reading
