HAZY TIGER
Also known as Bitter, T-APT-17, APT-C-08, Orange Yali, TA397
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.
Targets: Germany
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or ServiceT1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data ExchangeT1566.001 Spearphishing AttachmentT1568 Dynamic ResolutionT1573 Encrypted ChannelT1583.001 DomainsT1588.002 ToolT1608.001 Upload MalwareT1660 Phishing
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf
- https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
- https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats
- https://attack.mitre.org/groups/G1002
- https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html
- https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.