The PolySwarm Blog

Regions Targeted: South Asia
Related Families: BITTER APT
Related Threat Actors: PapRAT, WmRAT

Executive Summary

The suspected South Asian cyberespionage group BITTER has been linked to a campaign targeting organizations in South Asia through three infection chains that combine legitimate Windows utilities, malicious shortcuts, and custom remote access malware. PapRAT, a remote access trojan (RAT) developed in C++ and Rust, is capable of executing commands, transferring files, capturing screenshots, and maintaining attacker access. The campaign demonstrates how threat actors can blend native Windows functionality with custom implants to evade conventional detection and support persistent espionage operations.

Verticals Targeted: Government, Defense, Technology, Transportation, Critical Infrastructure
Regions Targeted: South Asia, Southeast Asia, East Asia
Related Families: ShadowPad, GODZILLA, NOODLERAT, IOX, GOST, Wstunnel, RingQ, VShell

Executive Summary

A newly identified China-aligned cyberespionage campaign tracked as SHADOW-EARTH-053 is targeting government agencies, defense-adjacent contractors, and critical infrastructure organizations across Asia through exploitation of unpatched Microsoft Exchange and IIS vulnerabilities. The operation relies heavily on legacy Exchange flaws, web shell persistence, ShadowPad malware deployment, credential theft, and covert tunneling infrastructure to maintain long-term access within victim environments. The campaign demonstrates that older but still-exploitable enterprise infrastructure continues to provide reliable access opportunities for state-aligned espionage operators and reinforces the operational importance of proactive detection, behavioral monitoring, and layered telemetry visibility.