# Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

Source: [The Hacker News](https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html) · 2026-11-09 · Security
Page: https://themorning.dev/story/bitter-hackers-deploy-new-paprat-backdoor-in-cyberespionage-campaign-targeting-s-7bdf0c6dc5dcaaf0
Kind: security · Impact: medium

## In brief

- The South Asia-focused cyberespionage group Bitter (also tracked as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17 and TA397) is targeting South Asian organizations.
- The campaign uses a previously unreported remote access trojan called PapRAT.
- PapRAT is reported to be written in both C++ and Rust.

## Why it matters

Organizations in South Asia, and their developers and IT staff, face a newly documented remote access trojan used for espionage, so detection and hardening matter.

## Timeline

- 2026-11-09: The Hacker News reports Bitter's new PapRAT backdoor campaign targeting South Asia

## Coverage

- [Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia](https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html) — The Hacker News, 2026-11-09

Tags: malware, cyberespionage, apt, south-asia, remote-access-trojan

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev