Log in Request a demo

Threat group profile

BITTER

Also known as T-APT-17

MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage group, active since at least 2013, that has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia.

In short

MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage group, active since at least 2013, that has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia. It sends spearphishing emails with malicious attachments and exploits known flaws in Microsoft Office.

Last updated October 2026

Profile MapThreat Group
  1. Names3names in public reportsBITTER · T-APT-17 · Bitter
  2. Sectors6named as targetsBangladesh · Middle East and North Africa · Not stated
  3. Techniques18in the attack chainResource Development · Initial Access · Execution
  4. Tools5tools and malware listedZxxZ · ProSpy · PuTTY

In one minute

Who they are
MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage group, active since at least 2013. None of the government sources opened names a country behind it.
Who they target
MITRE says it has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia. CERT-EU's April 2026 brief reports a campaign that researchers associate with BITTER against civil society members, journalists and opposition politicians in the Middle East and North Africa.
How they usually get in
Spearphishing emails with a malicious RTF document or Excel spreadsheet, and exploits of known Microsoft Office flaws, as MITRE describes. MITRE also lists links sent by SMS, WhatsApp and social media that deliver malicious mobile apps.
What stands out
MITRE lists a mix of Windows email attacks and mobile phishing. Sources opened give no comparison with other groups, so nothing more is claimed here.
What to do first
Patch Microsoft Office and Windows, block unexpected RTF and Excel attachments, train staff to spot spearphishing, and warn staff not to install apps from links sent by SMS or chat.

Names

Public reports use several names for this activity.

Names used for BITTER
NameWhere it appears
BITTER Main name on the MITRE ATT&CK group page G1002[1]
T-APT-17 Listed under Associated Groups on the MITRE ATT&CK group page[1]
Bitter Name used in the CERT-EU Cyber Brief 26-05 (April 2026)[3]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Describes BITTER as a suspected South Asian cyber espionage threat group that has been active since at least 2013.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Says BITTER has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia.[1]

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Lists T-APT-17 as an associated group name.[1]

  • MITRE ATT&CK 10 April 2024 (page last modified)

    Says the ZxxZ trojan has been used by BITTER since at least August 2021, including against Bangladeshi government personnel.[2]

  • CERT-EU April 2026

    Reported that researchers associate a hack-for-hire espionage campaign, active since at least 2022, with threat actor Bitter. CERT-EU repeats the researchers' finding and does not make its own attribution.[3]

Where sources differ

No source opened names a country behind BITTER. MITRE ATT&CK says only that it is a suspected South Asian group. The CERT-EU brief of April 2026 repeats what researchers reported about a campaign they associate with Bitter and does not attribute it to a state. Sources do not contradict each other, but attribution to any country is not established by the government pages opened.

Who they target

Sectors

  • Pakistan, China, Bangladesh, Saudi ArabiaMITRE says BITTER has targeted government organizations in these four countries.[1]
  • Pakistan, China, Bangladesh, Saudi ArabiaMITRE says BITTER has targeted energy organizations in these four countries.[1]
  • Pakistan, China, Bangladesh, Saudi ArabiaMITRE says BITTER has targeted engineering organizations in these four countries.[1]
  • BangladeshMITRE says the ZxxZ trojan, used by BITTER since at least August 2021, was used against Bangladeshi government personnel.[2]
  • Middle East and North AfricaCERT-EU reports that researchers associate a hack-for-hire campaign against these groups, active since at least 2022, with Bitter.[3]
  • Not statedMITRE says BITTER delivered malicious applications through shortened URLs sent by SMS, WhatsApp and social media.[1, 9]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. At least 2013

    Earliest activity

    MITRE says BITTER has been active since at least 2013.[1]

  2. August 2021

    ZxxZ in use

    MITRE says the ZxxZ trojan has been used by BITTER since at least August 2021.[2]

  3. 3 November 2021

    Exploited flaws added to US catalog

    CISA added CVE-2021-1732 and four Microsoft Office flaws, which MITRE says BITTER has exploited, to its Known Exploited Vulnerabilities catalog. The catalog does not mention BITTER.[1, 4]

  4. 1 June 2022

    MITRE profile created

    MITRE created its BITTER group page, G1002.[1]

  5. 2022

    Hack-for-hire campaign starts

    CERT-EU reports a campaign associated with Bitter that was active since at least 2022.[3]

  6. 8 April 2026

    Campaign reported

    Researchers reported the hack-for-hire campaign against civil society in the Middle East and North Africa, as summarized by CERT-EU.[3]

  7. 31 July 2026

    MITRE profile updated

    MITRE last modified the BITTER page, version 1.1.[1]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about BITTER
DateWhoWhat
3 November 2021 CISA Known Exploited Vulnerabilities listingAdded CVE-2021-1732 (Win32k) and CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, CVE-2018-0802 (Microsoft Office or related) to the catalog, with a required fix date. The entries do not name BITTER.[4]
April 2026 CERT-EU Threat intelligence briefCyber Brief 26-05 included a summary of the Bitter-linked campaign against civil society in the Middle East and North Africa.[3]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Acquire Infrastructure: Domains T1583.001

    MITRE says BITTER registered a variety of domains to host malicious payloads and for command and control.[1, 14]

  • Stage Capabilities: Upload Malware T1608.001

    MITRE says BITTER registered domains to stage payloads.[1]

  • Obtain Capabilities: Tool T1588.002

    MITRE says BITTER obtained tools such as PuTTY for its operations.[1]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE says BITTER sent spearphishing emails with a malicious RTF document or Excel spreadsheet.[1, 5]

  • Phishing T1660

    MITRE says BITTER delivered malicious applications through shortened URLs sent by SMS, WhatsApp and social media.[1, 9]

  • Spearphishing via fake social media personas

    CERT-EU reports the campaign researchers associate with Bitter used spearphishing through fake social media personas, and credential theft and account compromise against iOS users.[3]

Execution

  • Exploitation for Client Execution T1203

    MITRE says BITTER exploited Office flaws CVE-2012-0158, CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802.[1, 6]

  • User Execution: Malicious File T1204.002

    MITRE says BITTER tried to lure victims into opening malicious attachments sent by spearphishing.[1, 8]

  • Inter-Process Communication: Dynamic Data Exchange T1559.002

    MITRE says BITTER ran OLE objects through Microsoft Equation Editor to download and run payloads.[1, 11]

Persistence

  • Scheduled Task/Job: Scheduled Task T1053.005

    MITRE says BITTER used scheduled tasks for persistence and execution.[1, 13]

Privilege Escalation

  • Exploitation for Privilege Escalation T1068

    MITRE says BITTER exploited CVE-2021-1732 for privilege escalation.[1, 7]

Command and Control

  • Ingress Tool Transfer T1105

    MITRE says BITTER downloaded additional malware and tools onto a compromised host.[1, 10]

  • Dynamic Resolution T1568

    MITRE says BITTER used DDNS (dynamic DNS) for command and control.[1, 15]

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE says BITTER used HTTP POST requests for command and control.[1]

  • Non-Application Layer Protocol T1095

    MITRE says BITTER used TCP for command and control.[1]

  • Encrypted Channel T1573

    MITRE says BITTER encrypted its command and control communications.[1]

Stealth

  • Masquerading: Masquerade Task or Service T1036.004

    MITRE says BITTER disguised malware as a Windows Security update service.[1, 12]

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    MITRE says BITTER used a RAR SFX dropper to deliver malware.[1]

Tools and malware

  • ZxxZ Windows trojan

    MITRE describes it as a trojan written in Visual C++ used by BITTER since at least August 2021. MITRE lists XOR string decryption, downloading further files, disguise as a Windows security service, persistence through scheduled tasks and collection of system details such as host name, operating system name and user name.[2]

  • ProSpy Android spyware

    CERT-EU reports that the campaign researchers associate with Bitter used ProSpy delivered through fraudulent messaging app lures.[3]

  • PuTTY Legitimate remote access tool

    MITRE says BITTER obtained tools such as PuTTY for its operations.[1]

  • RAR SFX dropper Self-extracting archive

    MITRE says BITTER used a RAR self-extracting dropper to deliver malware.[1]

  • Microsoft Equation Editor OLE objects Document exploit method

    MITRE says BITTER ran OLE objects through Microsoft Equation Editor to download and run payloads.[1, 11]

Detection and defense

  1. Patch Office and Windows

    Apply updates for the Microsoft Office and Windows flaws BITTER is said to have used. CISA lists all five as exploited in the wild. MITRE advises regular patching against client and privilege escalation exploits.

    Counters T1203 T1068

  2. Block risky attachments

    Block unknown or unused attachment types by default and filter inbound email attachments, as MITRE advises.

    Counters T1566.001

  3. Train staff

    Train users to recognize spearphishing and to be wary of unexpected files, as MITRE advises.

    Counters T1566.001 T1204.002

  4. Limit exploit impact

    Use application isolation and exploit protection so that a successful document exploit does less damage.

    Counters T1203 T1068

  5. Watch scheduled tasks

    Look for new scheduled tasks and services with names that copy Windows security updates.

    Counters T1053.005 T1036.004

  6. Watch lookalike domains

    Register similar domains to your own where practical, and monitor DNS for newly purchased domains used against you, as MITRE suggests.

    Counters T1583.001

  7. Treat mobile links with care

    Tell staff not to install apps from shortened links sent by SMS, chat or social media.

    Counters T1660

What Brandefense can do

Questions

Who is BITTER?

MITRE ATT&CK describes BITTER as a suspected South Asian cyber espionage threat group that has been active since at least 2013. No government source opened names a country behind it.

Who does BITTER target?

MITRE says it has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia. CERT-EU reports a campaign researchers associate with Bitter against civil society in the Middle East and North Africa.

How does BITTER get in?

MITRE lists spearphishing emails with malicious RTF or Excel files and exploits of Microsoft Office flaws. It also lists malicious mobile apps sent through links in SMS, WhatsApp and social media.

Which flaws are linked to BITTER?

MITRE names CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, CVE-2018-0802 and CVE-2021-1732. CISA lists all five in its Known Exploited Vulnerabilities catalog.

What should a company do first?

Patch Microsoft Office and Windows, block unexpected attachments and train staff to spot spearphishing.

What malware does BITTER use?

MITRE names the ZxxZ trojan for Windows, used since at least August 2021. CERT-EU reports ProSpy Android spyware in a campaign researchers associate with Bitter.

How does BITTER communicate with infected machines?

MITRE lists HTTP POST requests, TCP connections, encrypted traffic and dynamic DNS, with domains registered to host payloads and for command and control.

Is BITTER a state group?

No source opened says so. MITRE calls it a suspected South Asian group, and CERT-EU describes a hack-for-hire campaign that researchers associate with Bitter.

In our research

  1. Hazy Tiger: An Emerging Espionage Threat in South Asia November 2025
  2. Industries Cybercriminals Target and Why They Are Exposed April 2025
  3. Bitter APT Targets Bangladesh’s Key Institutions Through Phishing Emails May 2022

Sources

  1. BITTER, T-APT-17, Group G1002 MITRE ATT&CK Supports: Group description, names, targets, techniques, software
  2. ZxxZ, Software S1013 MITRE ATT&CK Supports: ZxxZ trojan used by BITTER since at least August 2021
  3. Cyber Brief 26-05 - April 2026 CERT-EU Supports: Hack-for-hire campaign associated with Bitter in the Middle East and North Africa
  4. Known Exploited Vulnerabilities Catalog CISA Supports: Listing of CVE-2021-1732 and four Office flaws as exploited, added 3 November 2021
  5. Phishing: Spearphishing Attachment, T1566.001 MITRE ATT&CK Supports: Technique, mitigations
  6. Exploitation for Client Execution, T1203 MITRE ATT&CK Supports: Technique, mitigations
  7. Exploitation for Privilege Escalation, T1068 MITRE ATT&CK Supports: Technique, mitigations
  8. User Execution: Malicious File, T1204.002 MITRE ATT&CK Supports: Technique, mitigations
  9. Phishing, T1660 (Mobile) MITRE ATT&CK Supports: Mobile phishing technique
  10. Ingress Tool Transfer, T1105 MITRE ATT&CK Supports: Technique
  11. Inter-Process Communication: Dynamic Data Exchange, T1559.002 MITRE ATT&CK Supports: Technique
  12. Masquerading: Masquerade Task or Service, T1036.004 MITRE ATT&CK Supports: Technique
  13. Scheduled Task/Job: Scheduled Task, T1053.005 MITRE ATT&CK Supports: Technique
  14. Acquire Infrastructure: Domains, T1583.001 MITRE ATT&CK Supports: Technique, mitigation
  15. Dynamic Resolution, T1568 MITRE ATT&CK Supports: Technique

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more