Operation Bitter Biscuit

Operation Bitter Biscuit is a targeted intrusion cluster associated with the Bisonal malware family and assessed as likely linked to China-based activity. The actor has been reported targeting organizations in Japan, South Korea, and Russia, with a focus on government and military or defense-related entities; some reporting also places information technology organizations among its targets. The group is known for spearphishing-led initial access and for exploiting CVE-2018-20250 to place a malicious Microsoft Word add-in that functions as a dropper. In observed intrusions, this led to deployment of a first-stage backdoor followed by additional Bisonal-stage payloads. The malware supported persistence, host and service discovery, process and drive enumeration, file upload and download, remote command execution, and staged payload delivery. Later-stage Bisonal variants used encrypted command-and-control communications via a customized RC4-like implementation, reflecting an evolution from older variants. Post-compromise activity attributed to this actor includes theft of files from internal file servers, attempts to steal browser, mail-client, and operating-system credentials, internal port scanning, and movement toward Active Directory infrastructure. The actor has also checked for and exploited MS17-010 to upload malware to additional Windows hosts, demonstrating lateral movement and post-exploitation capability. Tradecraft overlaps include reuse of Bisonal, Dynamic DNS-based command-and-control patterns, and tooling consistent with previously reported Operation Bitter Biscuit activity.