Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive Data

In a newly uncovered campaign, Bitter, also tracked as APT-Q-37, is pursuing high-value targets in government, electric power, and military sectors across China, Pakistan, and other strategic regions, using both malicious Office macros and a WinRAR path traversal vulnerability to deliver a C# backdoor and siphon sensitive data, according to Qi’anxin Threat Intelligence Center.

In Mode 1, a malicious XLAM file named Nominated Officials for the Conference[.]xlam prompts macro enablement, then deploys a backdoor by compiling a C# source into a DLL placed under ProgramData and launching it via InstallUtil, with persistence achieved through a Startup folder batch script.

In Mode 2, the attackers package a benign Document.docx and a concealed Normal[.]dotm inside a crafted RAR archive, so that opening the DOCX causes Word to load the tampered template and execute winnsc.exe, the same backdoor, from a remote share. Initial assumptions pointed to CVE-2025-8088, but testing indicated the vulnerability affects WinRAR versions prior to 7.12.

The backdoor collects device details and exfiltrates them via POST to a remote server, which then provides additional EXE payloads, demonstrating convergence on a single Bitter implant across multiple attack vectors. Researchers note multiple domains registered in April 2025 serving as the C2 infrastructure, underscoring the operational cohesion of Bitter’s campaign. according to Qi’anxin Threat Intelligence Center.