Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

thehackernews.com Nov 9, 2026

Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

Curated by Shubham · TechCapsules · Nov 9, 2026

AI-summarised brief · reviewed before publication

Bitter, a South Asian cyber‑espionage group, has deployed a new remote‑access trojan named PapRAT, featuring both C++ and Rust versions. The malware can execute commands, upload/download files, delete data, enumerate directories, capture screenshots, and run PowerShell scripts. It uses three infection chains: a living‑off‑the‑land script that harvests system data, a second script that retrieves logs from a separate domain, and a third that downloads an MSI installer to drop PapRAT and the older WmRAT. The campaign demonstrates refined, flexible access tactics.

💡 Why It Matters

· The use of multiple, script‑driven infection vectors shows how attackers can evade traditional signature‑based defenses, forcing organizations to scrutinize seemingly benign scripts and installers.

Capsules Cybersecurity

Read full article on thehackernews.com

CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high‑severity vulnerability in SonicWall SonicOS (CVE‑2026‑19868) to its Known Exploited Vulnerabilities catalog after reports of possible real‑world exploitation. The flaw allows users with alternate authentication credentials to bypass SAML‑enforced multi‑factor authentication on the SonicOS SSL‑VPN service. SonicWall confirmed the issue, urged customers to install the latest patch immediately, and highlighted additional high‑severity fixes for Federal Civilian Executive Branch agencies due by November 20, 2026.

💡 The vulnerability exposes a critical bypass of MFA, a cornerstone of modern identity security, potentially allowing attackers to gain unauthorized access to protected networks. Prompt patching is essential to prevent exploitation that could compromise sensitive federal data.

thehackernews.com · Nov 9

U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses

U.S. government agencies, including CISA, FBI, HHS, USDA, and DOT, issued a joint advisory warning that threat actors are targeting industrial refrigeration and cold‑chain monitoring systems worldwide. Attackers exploit unpatched or internet‑accessible controllers to force continuous heating or defrost cycles, risking fires, equipment damage, and massive inventory loss. The advisory urges operators to enforce strong authentication, patch systems, isolate OT devices, change default passwords, retire legacy hardware, and secure remote access. Recent incidents have affected supermarkets across Europe and the French Blood Establishment, raising temperatures to 50 °C and spoiling critical supplies.

💡 The attacks expose a critical vulnerability in the supply chain for temperature‑sensitive goods, threatening public health and food security. Prompt remediation is essential to prevent widespread spoilage and potential safety hazards.

thehackernews.com · Nov 9

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for…

Keplr wallet users who logged in with Google or Apple accounts suffered theft after a vulnerability in Web3Auth, the provider of the social‑login service, was exploited. The flaw gave the attacker access to private keys, allowing funds to be moved from compromised wallets. Web3Auth responded by using the same breach path to transfer assets from at‑risk accounts into designated recovery wallets before the thief could act, a process coordinated with Keplr. The rescue operation covered more than 44,000 wallets and moved over $6 million across Cosmos and Ethereum‑compatible chains. Wallets secured with recovery phrases or hardware devices were unaffected. Keplr has paused social‑login options, is investigating, and is working with Web3Auth to verify which accounts were impacted and to restore funds.

💡 The breach shows that convenient social‑login mechanisms can become a single point of failure for crypto custody, prompting a reassessment of authentication strategies in decentralized finance.

quantumcomputingreport.com · Nov 8

QNu Labs Introduces Corporate Quantum-Safe Training Supported by National Quantum Mission

Bengaluru‑based quantum cybersecurity firm QNu Labs has launched a 12‑hour corporate training program through its QNu Academy, aimed at preparing enterprise security teams for quantum‑safe migration. Backed by India’s National Quantum Mission, the three‑day curriculum targets CISOs, network architects and risk officers, teaching them to assess cryptographic vulnerabilities and plan transitions against threats such as “harvest now, decrypt later.” Modules cover quantum communications, Quantum Key Distribution, Quantum Random Number Generation, Post‑Quantum Cryptography, asset inventory management and algorithm selection, using case studies from QNu’s deployments in Indian defence and banking networks. Instruction is co‑led by QNu engineers and faculty from IITs, NITs and IISERs, with participants earning an NQM‑certified assessment. The program is offered as on‑site workshops for 15‑50 professionals and half‑day executive briefings for senior management.

💡 It equips Indian enterprises with practical skills to safeguard data before quantum computers become capable of breaking current encryption.

quantumcomputingreport.com · Nov 8

HKMA and HKUST Launch PQC Toolkit to Accelerate Banking Sector Transition by…

The Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) unveiled a Post‑Quantum Cryptography (PQC) Toolkit at the FiNETech 8 forum, creating an operational and supervisory framework for licensed banks to replace vulnerable classical public‑key encryption. The move follows a July 2026 baseline audit that gave Hong Kong’s banking sector a Quantum Preparedness Index (QPI) of 2.3 out of 10, prompting a target of a perfect 10.0 by 2030. Co‑developed by HKMA supervisors and HKUST faculty, the toolkit guides banks in inventorying public‑key dependencies in transaction engines, SWIFT gateways and hardware security modules, and provides templates for auditing third‑party vendors. Ongoing updates will align the framework with evolving NIST standards and supervisory best practices.

💡 By institutionalising a clear migration path, Hong Kong aims to safeguard its financial infrastructure against future quantum attacks before global standards solidify.

thehackernews.com · Nov 6

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on…

A newly disclosed OpenSSH flaw, CVE‑2026‑123158 (SSHole), allows attackers to authenticate to accounts with no password set on musl‑based Linux systems, including Alpine Linux, by supplying oversized passwords. The vulnerability stems from a 2016 patch that misinterpreted failed hash attempts as successful logins when the account’s password field contains an asterisk. Within nine hours of disclosure, threat actors achieved root access on an Alpine honeypot, demonstrating the flaw’s immediacy. Users must upgrade to OpenSSH 10.6p2 and review logs for unauthorized password acceptance.

💡 The rapid exploitation underscores the urgency of patching OpenSSH on musl‑based distributions, as the flaw grants attackers full account privileges without credential theft. Prompt updates and vigilant log monitoring are essential to prevent potential lateral movement and infrastructure compromise.