Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

The South Asian espionage group Bitter has been observed targeting organisations in South Asia with a previously unreported remote access trojan called PapRAT, according to Fortinet FortiGuard Labs. PapRAT, which has C++ and Rust implementations, supports command execution, file upload and download, screenshot capture and, in the Rust variant, PowerShell execution, and is delivered through three infection chains using LNK files, a VHDX disk image and URL shortcuts.