--- title: PapRAT Cyber Espionage Campaign Leaves BITTER Taste in... description: The threat group BITTER, also known as TA397, is running a cyber espionage campaign against organizations in South Asia using a custom remote access Trojan... canonical: https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PapRAT Cyber Espionage Campaign Leaves BITTER Taste in South Asia | daily.dev og:description: The threat group BITTER, also known as TA397, is running a cyber espionage campaign against organizations in South Asia using a custom remote access Trojan... og:url: https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7 og:image: https://api.daily.dev/og/posts/zmJdzeRf7.png og:image:alt: PapRAT Cyber Espionage Campaign Leaves BITTER Taste in South Asia og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PapRAT Cyber Espionage Campaign Leaves BITTER Taste in South Asia **[Dark Reading](https://daily.dev/sources/dr)** · 4 min read · 0 upvotes · 0 comments ## Summary The threat group BITTER, also known as TA397, is running a cyber espionage campaign against organizations in South Asia using a custom remote access Trojan called PapRAT. FortiGuard Labs attributes the attacks with high confidence and documents three distinct infection chains, all abusing legitimate Windows functionality like ftp.exe, scheduled tasks, VHDX disk images, and MSI installers. BITTER rewrote PapRAT from C++ to Rust, expanding it from 8 to 11 commands, adding PowerShell execution, a sleep directive, and a clean-exit command. One chain also deploys a secondary implant called WmRAT. Researchers warn that removing PapRAT alone may not remove attacker access, since scheduled tasks and scripts can persist. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is PapRAT malware and what can it do on a compromised Windows system? PapRAT is a custom remote access Trojan used by the BITTER threat group (also called TA397) that gives attackers extensive control over compromised Windows systems. It can execute commands, manipulate files, capture screenshots, and download additional payloads. BITTER recently rewrote it from C++ to Rust, expanding its command set from 8 to 11, adding PowerShell execution, a sleep directive, and a clean-exit command. _Security teams tracking RAT capabilities and new malware variants can follow research like this on daily.dev._ ### How does the BITTER APT group abuse legitimate Windows tools to avoid detection? BITTER uses three attack chains that abuse native Windows features: a malicious LNK file that leverages ftp.exe to create scheduled tasks for command-and-control, a VHDX disk image with an LNK file that opens a decoy spreadsheet while silently running an MSI installer, and a URL shortcut that fetches an LNK file via WebDAV leading to an MSI installer deploying PapRAT and a secondary implant, WmRAT. _Defenders studying living-off-the-land techniques can track reports like this one on daily.dev._ ## Similar posts on daily.dev - [Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia](https://daily.dev/posts/transparent-tribe-launches-new-rat-attacks-against-indian-government-and-academia-czwn6hdlu) · The Hacker News · 2 upvotes · 0 comments - [ClickFix Campaign Generated Via AI Delivers SmartRAT](https://daily.dev/posts/clickfix-campaign-generated-via-ai-delivers-smartrat-r7higkqal) · Security Boulevard · 0 upvotes · 0 comments - [This stealthy Windows RAT holds live conversations with its operators](https://daily.dev/posts/this-stealthy-windows-rat-holds-live-conversations-with-its-operators-5bhtgzqlt) · CSO Online · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PapRAT Cyber Espionage Campaign Leaves BITTER Taste in South Asia","url":"https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7"},"datePublished":"2026-11-02T14:08:11.955Z","dateModified":"2026-11-02T14:18:53.484Z","description":"The threat group BITTER, also known as TA397, is running a cyber espionage campaign against organizations in South Asia using a custom remote access Trojan...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2dbd2dea652d6052c835b5fa1cbff22d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2dbd2dea652d6052c835b5fa1cbff22d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,rust,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"PapRAT Cyber Espionage Campaign Leaves BITTER Taste in South Asia"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/paprat-cyber-espionage-campaign-leaves-bitter-taste-in-south-asia-zmjdzerf7#faq","mainEntity":[{"@type":"Question","name":"What is PapRAT malware and what can it do on a compromised Windows system?","acceptedAnswer":{"@type":"Answer","text":"PapRAT is a custom remote access Trojan used by the BITTER threat group (also called TA397) that gives attackers extensive control over compromised Windows systems. It can execute commands, manipulate files, capture screenshots, and download additional payloads. BITTER recently rewrote it from C++ to Rust, expanding its command set from 8 to 11, adding PowerShell execution, a sleep directive, and a clean-exit command. Security teams tracking RAT capabilities and new malware variants can follow research like this on daily.dev."}},{"@type":"Question","name":"How does the BITTER APT group abuse legitimate Windows tools to avoid detection?","acceptedAnswer":{"@type":"Answer","text":"BITTER uses three attack chains that abuse native Windows features: a malicious LNK file that leverages ftp.exe to create scheduled tasks for command-and-control, a VHDX disk image with an LNK file that opens a decoy spreadsheet while silently running an MSI installer, and a URL shortcut that fetches an LNK file via WebDAV leading to an MSI installer deploying PapRAT and a secondary implant, WmRAT. Defenders studying living-off-the-land techniques can track reports like this one on daily.dev."}}]} ```