Loading threat actor…
Bitter is an India-linked cyberespionage group active since at least 2014, also tracked as APT-C-08, TA397, Hazy Tiger, Manlinghua, and T-APT-17. It conducts intelligence-gathering operations assessed to support Indian government interests. Its targeting includes Pakistani nationals and officials, Chinese organizations, organizations in Saudi Arabia, and the Turkish defense sector. Telecommunications personnel are a documented target, including specialists responsible for 5G infrastructure, satellite communications, DevOps, and project management. The group operates against Windows and Android systems. Initial-access methods include spearphishing, malicious Office documents, exploitation of Microsoft Equation Editor vulnerabilities, deceptive mobile applications, and malware distribution through compromised legitimate websites. Its lures frequently exploit regional geopolitical developments, Kashmir-related issues, religious interests, and professional responsibilities. Bitter has also used the Windows privilege-escalation vulnerability CVE-2021-1732. Bitter maintains an evolving arsenal of downloaders, backdoors, remote-access trojans, keyloggers, and file stealers. Windows tooling includes ArtraDownloader, MuuyDownloader, WSCSPL, BDarkRAT, AlmondRAT, WmRAT, ORPCBackdoor, MiyaRAT, and KiwiStealer. The KugelBlitz shellcode loader has been used to deploy Havoc during hands-on activity. Android operations progressed from AndroRAT-derived malware to the customized BitterRAT, also called SlideRAT, which collects communications, call recordings, location information, device details, and files. Recurring behaviors include host reconnaissance, remote command execution, screenshot capture, file collection and exfiltration, and persistence through Windows registry autorun entries. Its malware uses string obfuscation, encrypted configuration data, and encrypted communications, with command-and-control implementations spanning TCP, HTTP, HTTPS, and RPC. Some Android variants retrieve command-and-control configuration from Firebase. Bitter combines iterative malware development with hands-on post-compromise activity rather than uniformly relying on sophisticated payload-level anti-analysis.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
25 malware families attributed to this actor across reporting.
20 additional families tracked in Mallory.
10 CVEs this actor has used in observed campaigns. 10 of them exploited in the wild.
Cloud Atlas downloaded malicious RTF templates containing an exploit for CVE-2017-11882. The exploit executed shellcode in EQNEDT32.EXE and downloaded an HTA file. A similar delivery chain documented in 2018 delivered the PowerShower backdoor. The report also describes documents exploiting the same Equation Editor vulnerabilities that were attributed to Bitter APT.
While analyzing the CVE-2021-1732 exploit originally discovered by the DBAPPSecurity Threat Intelligence Center and used by the BITTER APT group, we discovered another zero-day exploit we believe is linked to the same actor.
The campaign predominantly used the older, relatively popular Microsoft Office exploit, CVE-2012-0158, in order to download and execute a RAT binary from a website.
While the malicious RTF document exploits a memory corruption vulnerability in Microsoft Office's Equation Editor (CVE-2017-11882), the Excel file abuses two remote code execution flaws, CVE-2018-0798 and CVE-2018-0802, to activate the infection sequence.
While the malicious RTF document exploits a memory corruption vulnerability in Microsoft Office's Equation Editor (CVE-2017-11882), the Excel file abuses two remote code execution flaws, CVE-2018-0798 and CVE-2018-0802, to activate the infection sequence.
5 more CVEs tied to this actor tracked in Mallory.
315 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed in the detection's technique annotations; the content does not attribute ShieldCrash exploitation to this group.
Listed in the detection annotation metadata.
Listed only as an annotation associated with the detection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.