Bitter

Summary

South Asian APT group assessed as India-aligned, targeting regional adversaries since 2013. Germany's BSI has listed Bitter (Hazy Tiger) among APT groups active against targets in Germany since June 2024 (list re-issued April 2026), without publishing intrusion dates; Proofpoint also observes regular targeting of European organisations with interests in China and Pakistan. Primary attack vectors are CHM (compiled HTML help) files and RAR archives delivered via spearphishing, often themed around defense procurement and diplomatic topics. Deploys BitterRAT, ArtraDownloader, and ZxxZ malware families. Campaigns have targeted Chinese military, nuclear, and energy research institutions, Bangladeshi government, and Pakistani government/military.

Attribution

No service publicly named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Proofpoint / Threatray (Research, 2025-06-04)
  Highly likely state-backed, tasked in the interests of the Indian state
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Suspected South Asian

Campaigns 6

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 7

Exploited vulnerabilities 6

Highest CVSS first.

Infrastructure patterns

• Recurring domain-registration patterns for its staging infrastructure, as TA397 (Proofpoint, 2024)

Reporting and advisories 7

• BSI
  Active APT Groups in Germany (April 2026)
• Proofpoint
  Hidden in Plain Sight: TA397's new attack chain delivers espionage RATs (WmRAT, MiyaRAT)
• Proofpoint / Threatray
  The Bitter End: unravelling eight years of espionage antics — joint assessment of Indian state backing
• EclecticIQ
  PTCL targeted by Bitter APT during heightened regional conflict
• MITRE ATT&CK
  Bitter (G1002) group profile
• Intezer
  Chinese Nuclear Research Targeting
• QiAnXin RedDrip
  WinRAR Normal.dotm hijack — C# backdoor (cayote.log)