Bitter APT Deploying New PapRAT Malware in South Asia

The South Asian cyberespionage group Bitter (also known as APT-C-08 and Hazy Tiger) has been observed deploying a new remote access trojan (RAT) dubbed PapRAT. This malware features both C++ and Rust implementations and is designed for extensive system reconnaissance, file exfiltration, and arbitrary command execution. The campaign specifically targets organizations within South Asia, continuing the group's long-standing focus on regional intelligence gathering.

The attack methodology is highly modular, utilizing three distinct infection chains that blend Living-off-the-Land (LotL) techniques with custom binaries. Techniques include abusing native utilities like ftp.exe and curl for script execution and file transfer, as well as utilizing VHDX disk images and WebDAV to bypass traditional perimeter defenses. Once established, PapRAT serves as a primary backdoor and, in some instances, a stager for the group's known WmRAT malware.

This campaign highlights Bitter's evolving tradecraft, particularly the adoption of Rust-based malware to increase operational flexibility and evade signature-based detection. The use of server-side command updates allows the attackers to change behavior without dropping new files, making them significantly harder to track through traditional endpoint detection.