FORENSIA

THREAT_ACTOR · G1002

BITTER

Also known as: BITTER, T-APT-17

Profile

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.

MITRE ATT&CK ↗

Techniques

16 ATT&CK techniques attributed to this actor.

T1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or ServiceT1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data ExchangeT1566.001 Spearphishing AttachmentT1568 Dynamic ResolutionT1573 Encrypted ChannelT1583.001 DomainsT1588.002 ToolT1608.001 Upload Malware

Software

1 malware/tools attributed to this actor.

ZxxZ

Related corpus activity

10,081 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to BITTER.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-0740cve—851
cve-2025-11837cve—852
cve-2014-2321cve—851
cve-2025-34117cve—851
cve-2026-1969cve—851
cve-2025-0921cve—852
cve-2013-3307cve—852
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2013-7471cve—851
cve-2021-29441cve—851
cve-2016-5681cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2022-47945cve—851
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2025-23304cve—852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2026-4368cveransomware851
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2026-3844cve—851

Showing the top 30 by severity of 10,081.