The Papa Bear Organization (APT-C-37) has launched organized, planned and targeted long-term uninterrupted attacks against Middle Eastern organizations for a while. Its attack platforms are Windows and Android. Current samples targeting the Middle East are that of H-worm. H-Worm is a VBS (Visual Basic Script) -based RAT. The attack uses the H-Worm version after obfuscation and mutation. After removing the obfuscation and analyzing, we find that its instruction list has not changed. A total of three RATs have been used on the Windows side, all of which have been popular in the Middle East for several years. Two of them are njRAT and H-worm.