hacker-news Nov 9, 2026 · Crawled Nov 10, 2026

Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

5 IoCs 1 Actors 1 Malware

AI Summary

The cyber espionage group Bitter, also known as APT-C-08 and other aliases, has deployed a new remote access trojan called PapRAT targeting organizations in South Asia. The malware, available in both C++ and Rust variants, enables command execution, file manipulation, screenshot capture, and PowerShell execution. The campaign uses multiple infection chains involving LNK files, VHDX disk images, and URL shortcuts to deliver PapRAT via MSI installers, leveraging living-off-the-land techniques and C2 infrastructure for reconnaissance and data exfiltration.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor HAZY TIGER → Malware WmRAT →

Indicators of Compromise 5 extracted

Type	Value	Detail
Domain	goodnfortunes[.]com	Details →
Domain	techtalkhelp[.]com	Details →
Domain	rivingtonclarks[.]com	Details →
Filename	abc.pdf	Details →
Filename	talk.log	Details →

MITRE ATT&CK TTPs 8 techniques

T1012 Query Registry · Discovery T1027 Obfuscated Files or Information · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1071.001 Web Protocols · Command And Control T1085 T1085 T1204.002 Malicious File · Execution T1566 Phishing · Initial Access