Bitter deploys PapRAT malware against South Asian organizations

The Bitter espionage group is targeting South Asian organizations with a previously unreported remote access trojan called PapRAT, Fortinet researchers found. The malware can execute commands, transfer and delete files, enumerate drives and capture screenshots; a Rust version also supports PowerShell execution. Researchers identified three infection chains using Windows shortcuts, disk images and MSI installers. One approach retrieves instructions from a remote server, allowing attackers to change commands without distributing a new executable. Another chain installs PapRAT and then drops WmRAT, malware previously associated with Bitter.