[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftKtE2vXJ4Acu6oEuw7Fpaa9pi74hmq4dYJe7pmjIvuM":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3e25c601-91e0-420f-b48c-0641b22f1611","Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia","bitter-hackers-deploy-new-paprat-backdoor-in-cyberespionage-campaign-targeting-s-99ca2c","The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. \"PapRAT has both C++ and Rust implementations,\" Fortinet FortiGuard Labs researcher Cara Lin said. \"Its capabilities include command execution, file","The Bitter threat group, also tracked as APT-C-08, APT-Q-37, and several other aliases, has launched a new cyberespionage campaign against South Asian targets using a previously unknown remote access trojan called PapRAT. The malware features both C++ and Rust implementations and includes capabilities for command execution and file operations. Fortinet FortiGuard Labs researchers documented the campaign, highlighting the group's continued focus on regional espionage activities.","Bitter APT deploys new PapRAT backdoor targeting South Asian organizations in cyberespionage campaign.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fbitter-hackers-deploy-new-paprat.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgQwQpjbb2oT57o807l7YmQ31V2RbyxqqO4hENkKlfikKKH-LeqSUiYz5AaPCCFWml-l_RaN1JMiwbJa9lJe7z7Ijzdk66icRP70eETLZ7lLomkSa3JjezoxbRNeDEkTv0K-26dSzHKxAjc7xyLA9RbIiERPLqyRu5QzfyrPeyIA4dfLzMil5wDkYN9n4sG\u002Fs1600\u002Fcommand.jpg","2026-11-09T14:31:29+00:00","2026-11-09T16:00:34.497934+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Bitter","threat_actor",{"name":21,"type":19},"APT-C-08",{"name":23,"type":19},"TA397",{"name":25,"type":19},"Hazy Tiger",{"name":27,"type":28},"Fortinet","vendor",{"name":30,"type":31},"FortiGuard Labs","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":36,"value":50,"context":51},"PapRAT","Previously unreported remote access trojan deployed by Bitter APT group in cyberespionage campaign targeting South Asia",[27,30],{"controls":54,"vendors":141},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":85,"name":86,"problem":87,"products":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":47,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[142],{"slug":143,"name":27,"logo_path":144,"roles":145},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"bitter-apt-deploys-paprat-backdoor-in-south-asian-espionage-campaign","Bitter APT Deploys PapRAT Backdoor in South Asian Espionage Campaign","The Bitter threat group has introduced PapRAT, a previously unknown remote access trojan with both C++ and Rust implementations, targeting South Asian organizations in a cyberespionage campaign. The use of a novel, dual-implementation RAT suggests deliberate efforts to evade signature-based detection tools that rely on known malware patterns. Once deployed, PapRAT enables attackers to execute commands and perform file operations, giving them persistent, stealthy access to compromised systems. This campaign underscores how advanced persistent threat actors continuously innovate their tooling to stay ahead of defenders, making behavioral detection and user awareness critical lines of defense.",[152,153,154,155,156,157,158],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":160,"MITRE ATT&CK T1566: Phishing":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 17: Incident Response Management":163,"CIS Control 14: Security Awareness and Skills Training":164,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":165,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":166},"NIS2 requires organizations to implement incident handling and monitoring measures that would help detect anomalous backdoor activity such as PapRAT's C2 communications before significant damage occurs.","APT groups like Bitter commonly use spearphishing as an initial access vector to deliver novel RATs like PapRAT; recognizing and blocking phishing attempts would disrupt the earliest stage of this campaign.","Timely patching and vulnerability remediation reduces the attack surface that APT actors can exploit to deliver novel malware during the initial infection phase.","A mature incident response plan with playbooks for RAT-based intrusions would enable faster detection, containment, and eradication of PapRAT before significant data exfiltration occurs.","Training employees to recognize socially engineered lures used by regional APT actors would reduce the likelihood of successful initial compromise in targeted espionage campaigns.","Systematic tracking and remediation of technical vulnerabilities would limit the exploitation opportunities available to threat actors deploying custom backdoors like PapRAT.","Enforcing least-privilege access and strong authentication limits the commands a backdoor like PapRAT can execute and the files it can access on behalf of a compromised user."]