Fortinet's FortiGuard Labs published research on 2 November 2026 on a campaign it attributes to BITTER, which it describes as a suspected South Asian cyberespionage group active since at least 2013 that has targeted the government, energy and engineering sectors. Over several months FortiGuard tracked attacks on South Asian organisations using PowerShell scripts and a custom remote access trojan it calls PapRAT, delivered through three infection chains: an LNK file that abuses the native Windows ftp.exe utility to run scripts and create scheduled tasks that keep in contact with the attacker's server; a VHDX disk image whose LNK opens a decoy spreadsheet while silently running an MSI installer that deploys PapRAT; and a RAR archive holding a .url shortcut that combines the first two.

PapRAT poses as a Microsoft component (bruzsvc.exe) and supports remote shell commands, file upload, download, deletion and execution, directory and drive listing and screenshots; a newer Rust variant expands the command set from eight to eleven, adding PowerShell execution, a sleep directive and a clean exit command.

FortiGuard says a secondary payload downloaded through PapRAT was WmRAT, which it cites as a further indicator linking the activity to BITTER, and that its telemetry shows targets concentrated in South Asia. Lure names include a request for a bilateral meeting during the 22nd HACGAM and a letter about the 11th Belt and Road Summit. (source: FortiGuard Labs)