Introduction
BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia. Cisco Talos Bitter Bangladesh May 2022 Forcepoint BITTER Pakistan Oct 2016
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1588.002 Tool
- T1568 Dynamic Resolution
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1027.013 Encrypted/Encoded File
- T1573 Encrypted Channel
- T1068 Exploitation for Privilege Escalation
- T1036.004 Masquerade Task or Service
- T1608.001 Upload Malware
- T1559.002 Dynamic Data Exchange
- T1203 Exploitation for Client Execution
- T1583.001 Domains
- T1053.005 Scheduled Task
- T1095 Non-Application Layer Protocol
- T1660 Phishing
ATT&CK technique IDs (denormalized)
- T1027.013
- T1036.004
- T1053.005
- T1068
- T1071.001
- T1095
- T1105
- T1203
- T1204.002
- T1559.002
- T1566.001
- T1568
- T1573
- T1583.001
- T1588.002
- T1608.001
- T1660
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [3] Forcepoint BITTER Pakistan Oct 2016 Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022. [4] Cisco Talos Bitter Bangladesh May 2022 Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.
Recent News
Latest articles from security news feeds mentioning this actor.
- Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia The Hacker News — 2026-11-09