Espionage Group Hides Malware in Windows Tools
Bitter's PapRAT campaign, tracked by Fortinet, abuses native utilities across South Asia, Southeast Asia and South Korea.
Updated on Nov. 2, 2026 in Cybersecurity
Fortinet's FortiGuard Labs attributed a South Asian cyber-espionage campaign to the threat group Bitter, also tracked as TA397, with high confidence. The campaign, tracked over several months and detailed in research published November 2, 2026, is a research-stage finding rather than a product or policy change.
Why it matters
The campaign pairs built-in Windows tools with a custom remote access trojan named PapRAT, a combination that makes malicious activity harder to separate from normal system use. Telemetry showing activity beyond South Asia, in Southeast Asia and South Korea, suggests the group's targeting reaches further than a single region.
The C++ build of PapRAT supports eight commands, and a later Rust variant adds three more, moving from plain HTTP to HTTPS. The third infection chain downloads WmRAT, a C++ remote access trojan that other researchers had previously documented.
The players
Fortinet FortiGuard Labs
The threat-research arm of cybersecurity company Fortinet, which publishes malware analysis and threat-actor attribution from its security-product telemetry.
Bitter
A cyber-espionage threat group, also tracked as TA397, attributed in this campaign to activity targeting South Asia.
The details
The first infection chain used a malicious Windows shortcut file that abused ftp.exe, a built-in file-transfer utility, to run scripts and create scheduled tasks, deploying no traditional malware executable. Those scheduled tasks used curl, a command-line tool for fetching data over the web, to pull fresh instructions from attacker servers. The lure files referenced a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit, and a 2026 gala dinner invitation, designed to look like legitimate diplomatic correspondence.
Timeline
FortiGuard Labs tracked the campaign over several months before publishing.
Fortinet published its research detailing the campaign on November 2, 2026.
The Tech Race
The campaign follows the living-off-the-land approach of using native Windows utilities to run malicious steps without a traditional executable. Its pairing with a custom PapRAT trojan, updated in a Rust variant, shows the group iterating its tooling across builds.
The campaign's lures and delivery method target government and diplomatic staff rather than general consumers, and the source gives no consumer-facing availability or pricing. Organizations in the named regions are the readers most likely to need to review how Windows scheduled tasks and built-in utilities are monitored.
The takeaway
The key trajectory is that attackers are leaning on tools already present on Windows systems, so detection that relies on spotting new executables will miss this style of intrusion. Watch for further FortiGuard Labs reporting on PapRAT's command set and any attribution updates for Bitter, which the source does not yet resolve.
Further reading
For the broader threat landscape behind campaigns like this one, explore our Cybersecurity coverage.
