Bitter APT Attacks China/Pakistan with WinRAR Zero-Day and New C# Backdoor via Office Macro

China-based cybersecurity firm Qianxin Threat Intelligence Center has uncovered a new wave of Bitter APT operations (APT-Q-37), targeting government, military, and electric power entities in China and Pakistan, among others, with a WinRAR zero-day and a new C# backdoor delivered through Office macros.

The campaign employs two intrusion chains: a macro-based vector using weaponised .xlam files that compile and install a C# backdoor on the victim’s system, and a WinRAR path traversal that overwrites the user’s Normal[.]dotm template to trigger the macro when a decoy document is opened.

The C# implant can fetch and execute payloads from attacker-controlled servers, and communicates over HTTPS to subdomains linked to Bitter’s infrastructure, including esanojinjasvc[.]com and keeferbeautytrends[.]com, with the latter hosting a kefe.bat persistence script. The WinRAR chain targets versions below 7.12 via an earlier, undocumented path traversal bug, while the macro chain decodes Base64-encoded C# that writes to C:\\programdata\\cayote.log and compiles a dll. According to Qianxin, these findings align with known Bitter APT techniques and mark a notable expansion of the group’s multi-stage delivery methods.