BITTER: threat actor profile

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. (MITRE ATT&CK, G1002)

Also known as: T-APT-17

Attacks we reported

Not in our reporting in the last 12 months.

16 techniques MITRE has documented for this group

1. Resource Development Acquire Infrastructure: Domains T1583.001 · Obtain Capabilities: Tool T1588.002 · Stage Capabilities: Upload Malware T1608.001
2. Initial Access Phishing: Spearphishing Attachment T1566.001
3. Execution Scheduled Task/Job: Scheduled Task T1053.005 · Exploitation for Client Execution T1203 · User Execution: Malicious File T1204.002 · Inter-Process Communication: Dynamic Data Exchange T1559.002
4. Persistence Scheduled Task/Job: Scheduled Task T1053.005
5. Privilege Escalation Scheduled Task/Job: Scheduled Task T1053.005 · Exploitation for Privilege Escalation T1068
6. Stealth Obfuscated Files or Information: Encrypted/Encoded File T1027.013 · Masquerading: Masquerade Task or Service T1036.004
7. Command and Control Application Layer Protocol: Web Protocols T1071.001 · Non-Application Layer Protocol T1095 · Ingress Tool Transfer T1105 · Dynamic Resolution T1568 · Encrypted Channel T1573

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).