BITTER
BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.
- ATT&CK ID
- G1002
- Techniques
- 16
- Tools
- 1
Also tracked as T-APT-17
In the news
Vulnerabilities it has exploited
- CVE-2012-0158 Microsoft MSCOMCTL.OCXUnscored · exploited in the wild
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0798 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0802 Microsoft OfficeUnscored · exploited in the wild
- CVE-2021-1732 Microsoft Win32kUnscored · exploited in the wild
Techniques
Resource Development
Acquire InfrastructureObtain CapabilitiesStage Capabilities
Initial Access
Execution
Scheduled Task/JobExploitation for Client ExecutionUser ExecutionInter-Process Communication
Persistence
Privilege Escalation
Scheduled Task/JobExploitation for Privilege Escalation
Stealth
Obfuscated Files or InformationMasquerading
Command and Control
Application Layer ProtocolNon-Application Layer ProtocolIngress Tool TransferDynamic ResolutionEncrypted Channel
Software
ZxxZ