Bitter APT is a threat group that has targeted Bangladesh’s key institutions with phishing emails in a recent campaign. MITRE ATT&CK lists the group as BITTER, also tracked as T-APT-17. The emails carry malicious documents that exploit three Microsoft Office flaws, CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802, and then install the ZxxZ malware.
Who is Bitter APT and who does it target?
It has been detected that the threat actors known for their espionage campaigns targeting China, Pakistan, and Saudi Arabia have targeted Bangladesh institutions and organizations as part of this campaign. The tools and flaws involved match the Bitter APT profile on the MITRE ATT&CK group page, which lists the ZxxZ malware and the same three Office flaws among the group’s tools and exploits, and names Bangladesh among its targets. The group, also known as T-APT-17, is described by MITRE as targeting government, energy and engineering organizations.
How does the phishing attack work?
Threat actors submitted documents allegedly related to operational tasks to senior officers of the Bangladesh Police Rapid Action Battalion Unit (RAB) through phishing emails, which appear to be originated from Pakistan. The sender requests that the destinations review or validate a malicious document, a call data log (CDR), a list of phone numbers, or a list of registered cases, but emails contain a malicious RTF document or an Excel table to use to exploit known security vulnerabilities. With the view of the content of the documents, malicious software ZxxZ, which appears to be a Windows Security update service, is installed and run on the intended system. The documents exploit Microsoft Office vulnerabilities tracked as CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802, which allow an attacker to run arbitrary code on the target system.
How can organizations protect themselves?
Such campaigns allow threat actors to access the organization’s confidential information. In this context, to not be the target of similar attacks, it is recommended not to rely on e-mails, attachments, and links from unknown parties and to prefer comprehensive security solutions.