BITTER (G1002) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

About BITTER

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.

View MITRE record ↗

Techniques by Tactic (16)

Resource Development

T1583.001 DomainsT1588.002 ToolT1608.001 Upload Malware

Initial Access

T1566.001 Spearphishing Attachment

Execution

T1053.005 Scheduled TaskT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data Exchange

Persistence

T1053.005 Scheduled Task

Privilege Escalation

T1053.005 Scheduled TaskT1068 Exploitation for Privilege Escalation

Stealth

T1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or Service

Command & Control

T1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1568 Dynamic ResolutionT1573 Encrypted Channel

Toolsets (1)

🐛

ZxxZ S1013

Malware · Windows

References & Reports (2)

Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.
Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.

↑