Bitter

Profile narrative

Bitter, also tracked as Bitter APT or Project Bitter, is an advanced persistent threat group whose known operational base is located in India. The actor has been observed focusing its activities on South Asian targets, specifically military entities and government organizations in Bangladesh, as well as Pakistani government institutions. Its campaigns are described as cyber‑espionage operations aimed at intelligence gathering, with no public indication of financial gain or disruptive intent. The group’s strategic objective is consistently characterized as the acquisition of sensitive information from governmental and defense‑related entities.

Bitter gains initial access primarily through spear‑phishing emails that deliver weaponized Microsoft Office documents, including Excel spreadsheets and RTF files, which exploit known vulnerabilities such as CVE‑2018-0798, CVE-2017-11882 and CVE-2018-0802. Once opened, these files deploy the ZxxZ downloader, a 32‑bit Windows executable that retrieves a second‑stage Visual C++ implant functioning as a Remote Access Trojan. The malware incorporates anti‑detection techniques, including the replacement of a distinctive separator with an underscore in its fingerprinting function, obfuscation of strings, and the termination of antivirus processes. Persistence is achieved via scheduled tasks that re‑download the payload at regular intervals and through retry mechanisms that attempt reinfection up to 225 times before ceasing. Notable publicly reported operations include a May 2022 campaign against Bangladeshi military targets using weaponized Excel documents, an August 2021 operation targeting Bangladeshi government agencies with both RTF and Excel lures, and a November 2013 effort directed at Pakistani government institutions that employed similar spear‑phishing tactics and Android‑based surveillance tools. While the group’s location is noted as India, no public attribution to a specific state sponsor or criminal consortium has been established.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 2 sources.