Loading threat actor…
Bitter is a suspected South Asian state-aligned cyber espionage threat actor widely tracked as APT-C-08, TA397, T-APT-17, Hazy Tiger, Bitter APT, and Manlinghua. The group is commonly assessed as aligned with Indian strategic interests and has conducted long-running intelligence collection operations against government, defense, diplomatic, and other strategic targets, particularly in South Asia, while also targeting organizations in regions such as the Middle East and Europe, including Turkey and Pakistan. Bitter is known for spearphishing-led intrusion chains that use themed lures, malicious attachments, and deceptive download or credential-harvesting pages. Observed tradecraft includes phishing sites impersonating legitimate services to steal account credentials, delivery of malicious archives and script-based payloads, and use of scheduled tasks, Windows services, and script-based persistence mechanisms. The group has also staged payloads on actor-controlled infrastructure and used HTTP POST for command and control. The actor has been associated with malware and tooling including WmRAT, MiyaRAT, Remcos, and custom VBS-based components used for persistence, information theft, remote command execution, and host reconnaissance. Reported post-compromise behavior includes enumeration of processes and security products, collection of system information, exfiltration of victim data, and deployment of follow-on remote access trojans. Bitter has also been observed obtaining legitimate administrative tools such as PuTTY for operational use. Victimology and campaign reporting indicate a focus on espionage rather than disruption, with targeting often reflecting geopolitical priorities involving India, Pakistan, and neighboring regions. Bitter has also been linked by some researchers to broader India-nexus activity clusters and has been discussed alongside groups such as SideWinder and Confucius due to overlapping infrastructure, tooling, or tactics, though such overlaps do not necessarily imply the same operator. Subgroup reporting is limited, and no distinct internal sub-groups are firmly established in the available high-confidence public record.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
52 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
17 malware families attributed to this actor across reporting.
12 additional families tracked in Mallory.
9 CVEs this actor has used in observed campaigns. 9 of them exploited in the wild.
...has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158...
...has exploited Office vulnerabilities such as CVE-2017-11882...
BITTER has exploited Microsoft Office vulnerabilities... CVE-2018-0798...
...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.
BITTER has exploited CVE-2021-1732 for privilege escalation.
4 more CVEs tied to this actor tracked in Mallory.
30 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used phishing pages masquerading as an email service to steal credentials and deployed a VBS payload for persistence, theft, and remote command execution.
Referenced only as an India-nexus adversary with similarities to Mysterious Elephant.
Named as overlapping with TAG-179 in infrastructure, tooling, and TTPs in suspected India-nexus espionage against Pakistani law enforcement.
Listed as an annotation/tag associated with privilege escalation techniques in the detection content; no campaign or activity by the group is described in this reference.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.