Threat actor
Bitter
India
Tracked by CyberSIXT since 22 Oct 2025
- Articlesall time
- 5
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 3
5 articles from 4 outlets since 22 Oct 2025; the latest 200 days ago.
- Article
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 9 Apr · 12:10 UTC | The Hacker News | Indian hackers phish MENA journalists via fake Apple Google pages |
| Thu 9 Apr · 11:30 UTC | Infosecurity | Bitter APT Tied to Hack for Hire Spyware Aimed at Journalists |
| Tue 11 Nov 2025 · 13:36 UTC | GBHackers | WinRAR Vulnerability Exploited by APT-C-08 to Target Government Agencies |
| Wed 22 Oct 2025 · 10:21 UTC | GBHackers | Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive Data |
| Wed 22 Oct 2025 · 01:45 UTC | SecurityOnline | Bitter APT Attacks China/Pakistan with WinRAR Zero-Day and New C# Backdoor via Office Macro |
Who reported 4 outlets
- GBHackers2
- SecurityOnline1
- Infosecurity1
- The Hacker News1
) : ""}
Tactic coverageDistinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.
Names and sources
- HAZY TIGER
- CyberSIXT coverage, Malpedia, MISP Galaxy
- APT-C-08
- Malpedia, MISP Galaxy
- Bitter
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- Orange Yali
- Malpedia, MISP Galaxy
- T-APT-17
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- TA397
- Malpedia, MISP Galaxy
- Bitter APT
- CyberSIXT coverage
Attributed facts
- Origin
India MISP Galaxy
- Suspected victims
Germany MISP Galaxy
Malware and tools
MITRE ATT&CK® · G1002 1
Malpedia · hazy_tiger 9
MITRE ATT&CK® techniques
16 techniques · 7 tacticsFrom MITRE ATT&CK® · G1002
Values by tactic
Most recorded: Command and Control 5 · Execution 4 · Resource Development 3
Resource Development3
T1583.001DomainsT1588.002ToolT1608.001Upload MalwareInitial Access1
T1566.001Spearphishing AttachmentExecution4
T1053.005Scheduled TaskT1203Exploitation for Client ExecutionT1204.002Malicious FileT1559.002Dynamic Data ExchangePersistence1
T1053.005Scheduled TaskPrivilege Escalation2
T1053.005Scheduled TaskT1068Exploitation for Privilege EscalationStealth2
T1027.013Encrypted/Encoded FileT1036.004Masquerade Task or ServiceCommand and Control5
T1071.001Web ProtocolsT1095Non-Application Layer ProtocolT1105Ingress Tool TransferT1568Dynamic ResolutionT1573Encrypted Channel© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Indian hackers phish MENA journalists via fake Apple Google pagesThe Hacker News
- Bitter APT Tied to Hack for Hire Spyware Aimed at JournalistsInfosecurity
- WinRAR Vulnerability Exploited by APT-C-08 to Target Government AgenciesGBHackers
- Bitter APT Exploits WinRAR Zero-Day Through Malicious Word Files to Steal Sensitive DataGBHackers
- Bitter APT Attacks China/Pakistan with WinRAR Zero-Day and New C# Backdoor via Office MacroSecurityOnline · first in our coverage