BITTER Expands Its Arsenal with PapRAT

BITTER is a cyberespionage group targeting South Asian government, energy, and engineering sectors using a custom remote access trojan called PapRAT. PapRAT is deployed through multiple infection chains involving malicious LNK files, VHDX disk images with MSI installers, and URL shortcuts combined with WebDAV. The malware exists in C++ and Rust variants, with capabilities such as command execution, file and directory manipulation, screenshot capture, and secondary payload delivery. Persistence is maintained via scheduled tasks, and communication with command-and-control servers occurs over HTTP. The Rust variant adds enhanced features including PowerShell execution and sleep commands.

• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Integrating AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLMMalware2026-08-10