BITTER

Origin🇨🇳 China

Techniques (MITRE ATT&CK)16

SourceMITRE ATT&CK

Targeted regions: Germany

Also known as:APT-C-08Orange YaliT-APT-17TA397

About the group

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity50

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Tool Upload Malware

Initial access

Spearphishing Attachment

Execution

Scheduled Task Exploitation for Client Execution Malicious File Dynamic Data Exchange

Privilege escalation

Exploitation for Privilege Escalation

Command and control

Web Protocols Non-Application Layer Protocol Ingress Tool Transfer Dynamic Resolution Encrypted Channel

stealth

Encrypted/Encoded File Masquerade Task or Service

Exploited vulnerabilities 5

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2012-0158HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2018-0798HIGHEPSS 95%KEV MITRE ATT&CK

CVE-2018-0802HIGHEPSS 93%KEV MITRE ATT&CK

CVE-2021-1732HIGHEPSS 78%KEV MITRE ATT&CK

References

BITTER uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →