FortiGuard Labs has traced a Windows espionage campaign against South Asian organizations to BITTER, with high confidence. Its November 2 research describes activity tracked over several months, including a custom remote access trojan the researchers call PapRAT.
The attribution rests on lure filenames, command-and-control patterns, file metadata and malware analysis. It is FortiGuard’s assessment, rather than an independently confirmed identification of the operators. The report does not identify the affected organizations by name.
Shortcuts conceal the next step
One infection chain uses Windows shortcuts and the legitimate ftp.exe utility to run scripts and establish scheduled tasks. Two others deliver PapRAT through installers, using a disk image or a shortcut retrieved over WebDAV. A decoy spreadsheet helps disguise installation in one chain.
PapRAT can execute commands, transfer or delete files and capture screenshots. FortiGuard found C++ and Rust versions; the Rust build adds PowerShell execution and further controls. One delivery chain also deploys a second implant, WmRAT.
An established espionage pattern
MITRE ATT&CK’s BITTER profile records a suspected South Asian espionage group active since at least 2013, with historical targeting of government, energy and engineering organizations. It also documents malicious attachments and scheduled tasks in earlier activity. That history provides context; it does not establish the victims or full reach of this newly reported campaign.
For Windows defenders, Microsoft’s attack surface reduction reference describes controls for executable content arriving through email and for potentially obfuscated scripts. The latter supports PowerShell and requires Defender Antivirus, the Antimalware Scan Interface and cloud protection. These are defensive options to review against an organization’s configuration, rather than a claim that a single rule blocks every PapRAT delivery path. Microsoft’s documentation also specifies differing operating system support and alerting requirements.
Sources: FortiGuard Labs: PapRAT investigation; MITRE ATT&CK: BITTER; Microsoft: attack surface reduction rules reference.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
