Date: 11/03/2026
Severity: High
Summary
BITTER is a suspected South Asian cyberespionage group active since at least 2013, known for targeting government, energy, and engineering organizations. Labs recently identified a campaign targeting South Asian entities using malicious PowerShell scripts and a custom remote access trojan (RAT) named PapRAT. The malware enables attackers to maintain persistent access to compromised environments. Based on lure filenames, C2 communication patterns, file metadata, and malware analysis, Labs attributes this campaign to BITTER with high confidence.
Indicators of Compromise (IOC) List
Domains/URLs | netmansrvdns.com rappellingaart.com https://techtalkhelp.com/talk.log http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php https://goodnfortunes.com/ucl.php https://felixfuturenext.com/Epistemological/ http://gomescareerplans.com/docs |
Hash | a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c
e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b
ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88
569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33
411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "netmansrvdns.com" or url like "netmansrvdns.com" or siteurl like "netmansrvdns.com" or domainname like "rappellingaart.com" or url like "rappellingaart.com" or siteurl like "rappellingaart.com" or domainname like "http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php" or url like "http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php" or siteurl like "http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php" or domainname like "https://goodnfortunes.com/ucl.php" or url like "https://goodnfortunes.com/ucl.php" or siteurl like "https://goodnfortunes.com/ucl.php" or domainname like "https://felixfuturenext.com/Epistemological/" or url like "https://felixfuturenext.com/Epistemological/" or siteurl like "https://felixfuturenext.com/Epistemological/" or domainname like "http://gomescareerplans.com/docs" or url like "http://gomescareerplans.com/docs" or siteurl like "http://gomescareerplans.com/docs" or domainname like "https://techtalkhelp.com/talk.log" or url like "https://techtalkhelp.com/talk.log" or siteurl like "https://techtalkhelp.com/talk.log" |
Detection Query 2 : | sha256hash IN ("ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88","569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33","e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b","a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c","411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b")
|
Reference:
BITTER Cyberespionage Campaign Using PapRAT