Bitter Spy Group Rewrites Malware in Rust for South Asia Attacks

A cyber-espionage group called Bitter, also tracked as TA397, is targeting organizations across South Asia with an upgraded version of its custom remote access Trojan, PapRAT, FortiGuard Labs reported on November 2, 2026. Active since at least 2013 and linked to India, Bitter has historically gone after government, energy, and engineering targets.

Bitter rewrote PapRAT in Rust, moving it off C++ and adding PowerShell execution plus sleep and exit commands for 11 in total. The group runs three infection chains built on legitimate Windows features. One abuses ftp.exe and scheduled tasks without deploying any malware binary. In another, PapRAT pulls down a second implant, WmRAT.

Sectigo senior fellow Jason Soroko notes that wiping PapRAT from that chain’s victims may leave the attackers inside, so defenders should also hunt for leftover scripts, scheduled tasks, and extra payloads.

Source: Dark Reading