HAZY TIGERThreat actor
- APT-C-08
- Bitter
- orange yali
- t-apt-17
- ta397
The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.From MISP Galaxy
Last reported 12 days ago, by The Hacker News5 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1219Remote Access Tools
“The threat actor proceeded to take several steps, including installing additional remote access tools such as ScreenConnect or AnyDesk instances, to ensure persistent access to the environments.”
- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1053.005Scheduled Task
“This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server.”
- T1195Supply Chain Compromise
“On April 25, a supply-chain compromise reportedly targeted the elementary-data project, where a forged release was published to PyPI and a matching trojanised container image was pushed to the GitHub Container Registry.”
- T1555.005Password Managers
“The campaign impersonated legitimate developer tooling to deliver RAT-enabled infostealers targeting credentials, browser data, password managers, and cryptocurrency wallets.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“Bitter, another threat actor assessed to be operating with interests aligned to India, targeted a European embassy in Asia in June 2026 with a spear-phishing email bearing a FIFA World Cup-themed lure to deliver BDarkRAT.”
-
Cyber Brief 26-05 - April 2026“Threat actor Bitter linked to hack-for-hire campaign targeting MENA civil society”
-
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement“…ng, and TTPs overlap to varying degrees with those of the threat actors tracked by Kaspersky as Mysterious Elephant and by Qihoo 360 as APT-C-08 (a.k.a.”
-
RATs! Remote Management Software from the Hacker’s Perspective“We also spent some time discussing the wackiest and most alarming cases of RAT abuse from recent memory: Bitter Pill, a multi-stage attack against healthcare and pharmaceutical organizations that leveraged ScreenConnect for remote access and persistence.”
-
Bitter Pill“Bitter Pill”
Indicators in its reports
named in the reports above- fbijobs[.]govin 1 report
- 172.111.233[.]36in 1 report
- 172.111.233[.]96in 1 report
- 172.111.233[.]12in 1 report
- 172.111.233[.]105in 1 report
- 172.111.233[.]26in 1 report
- 172.94.9[.]49in 1 report
- 172.94.9[.]43in 1 report
- 172.94.9[.]19in 1 report
- 45.74.6[.]17in 1 report
- 45.125.32[.]218in 1 report
- 142.171.183[.]8in 1 report
- 193.42.25[.]65in 1 report
- 89.31.121[.]220in 1 report
- cms.balochistanpolice.gov[.]pkin 1 report
- 41.216.188[.]140in 1 report
- 000fad96a85dd693…ed47b7f1f066in 1 report
- 08570471f39bb672…99ed48c22686in 1 report
- 23f4766c011d193f…60e2a41ead79in 1 report
- 23f6781919a50b11…e63b71ecc885in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.