BITTER - G1002

Created: 2022-06-01T20:26:53.880Z

Modified: 2022-06-01T21:20:18.113Z

Contributors:

Aliases

BITTER,T-APT-17

Description

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has primarily targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)

Techniques Used

BITTER has registered domains to stage payloads.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

BITTER has registered a variety of domains to host malicious payloads and for C2.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

BITTER has exploited CVE-2021-1732 for privilege escalation.(Citation: DBAPPSecurity BITTER zero-day Feb 2021)(Citation: Microsoft CVE-2021-1732 Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

BITTER has obtained tools such as PuTTY for use in their operations.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568|Dynamic Resolution|

BITTER has used DDNS for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

BITTER has encrypted their C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|