BITTER is a cyberespionage group targeting South Asian government, energy, and engineering sectors using a custom remote access trojan called PapRAT. PapRAT is deployed through multiple infection chains involving malicious LNK files, VHDX disk images with MSI installers, and URL shortcuts combined with WebDAV. The malware exists in C++ and Rust variants, with capabilities such as command execution, file and directory manipulation, screenshot capture, and secondary payload delivery. Persistence is maintained via scheduled tasks, and communication with command-and-control servers occurs over HTTP. The Rust variant adds enhanced features including PowerShell execution and sleep commands.