# Bitter deploys PapRAT malware against South Asian organizations

_Published Monday, November 9, 2026 at 11:14 AM EST · Security · Latest · Tier 2 — Notable_

![Bitter deploys PapRAT malware against South Asian organizations — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQwQpjbb2oT57o807l7YmQ31V2RbyxqqO4hENkKlfikKKH-LeqSUiYz5AaPCCFWml-l_RaN1JMiwbJa9lJe7z7Ijzdk66icRP70eETLZ7lLomkSa3JjezoxbRNeDEkTv0K-26dSzHKxAjc7xyLA9RbIiERPLqyRu5QzfyrPeyIA4dfLzMil5wDkYN9n4sG/s1700-nu-rw-lo-l85-e365/command.jpg)

The Bitter espionage group is targeting South Asian organizations with a previously unreported remote access trojan called PapRAT, Fortinet researchers found. The malware can execute commands, transfer and delete files, enumerate drives and capture screenshots; a Rust version also supports PowerShell execution.

Researchers identified three infection chains using Windows shortcuts, disk images and MSI installers. One approach retrieves instructions from a remote server, allowing attackers to change commands without distributing a new executable. Another chain installs PapRAT and then drops WmRAT, malware previously associated with Bitter.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html)

---
Canonical: https://techandbusiness.org/newswire/cRskwsIX0YuHpFAu4wXmqk
Published: 2026-11-09T16:14:57.965Z
Story chronology: 2026-11-09T14:31:00.000Z
Retrieved: 2026-11-09T19:00:34.754Z
Publisher: Tech & Business (techandbusiness.org)