Bitter

Bitter is a South Asian espionage threat actor widely tracked as TA397 and also known by aliases including APT-C-08, T-APT-17, Hazy Tiger, Manlinghua, and APT-Q-37. The group is assessed with high confidence to be state-backed and to operate in support of Indian government intelligence interests. Bitter has conducted sustained cyber-espionage activity since at least the mid-2010s and has remained operational through 2025, with continued malware development and iterative refinement of its tooling. Bitter primarily targets government, military and defense-related entities, as well as energy, engineering, electric power, and nuclear-related organizations, with a geographic focus on South Asia and repeated operations against Pakistan, China, Saudi Arabia, and Bangladesh. Reporting also links the group to activity against Chinese enterprises and public-sector organizations, including military-industrial and power-sector targets. The actor is known for spear-phishing and document-based intrusion chains using weaponized Office and InPage files, malicious installers, and downloader stages hosted on compromised legitimate websites. Bitter has repeatedly exploited vulnerabilities including CVE-2017-11882, CVE-2018-0798, CVE-2018-0802, CVE-2017-12824, and has been linked to in-the-wild use of Win32k and Desktop Window Manager privilege-escalation zero-days including CVE-2021-1732 and CVE-2021-28310. Campaigns have used lures themed around regional political and military issues, including Kashmir and government or defense subjects. Its malware ecosystem has evolved from early downloaders into a broad arsenal of custom backdoors, stealers, loaders, and remote-access trojans. Documented families associated with Bitter include ArtraDownloader, MuuyDownloader, WSCSPL, BDarkRAT, AlmondRAT, WmRAT, ORPCBackdoor, MiyaRAT, KiwiStealer, KugelBlitz, ZxxZ, and BitterRAT. Across these families, recurring traits include systematic host reconnaissance, simple but consistent string obfuscation, increasing use of XOR and AES-based encryption, modular payload delivery, and code reuse across C, C++, .NET, and other implementations. Bitter commonly uses downloaders to stage later implants, then relies on hands-on-keyboard activity for follow-on operations rather than sophisticated anti-analysis in every payload. Observed capabilities include host profiling, persistence, keylogging, screenshot capture, file theft, directory traversal, shell and PowerShell command execution, remote file management, process execution, and exfiltration of documents and other victim data. Some tooling supports secondary payload delivery, shellcode loading, and deployment of commodity frameworks such as Havoc during post-compromise activity. Bitter has also used malware modules dedicated to persistence and credential or document collection, and has demonstrated privilege-escalation capability through exploitation. Operationally, Bitter overlaps with several South Asian intrusion clusters and has at times shown tooling or infrastructure relationships discussed alongside groups such as Patchwork, Bahamut, Confucius, Sidewinder, Donot, and Mysterious Elephant, but Bitter remains a distinct espionage actor with its own long-running malware lineage and targeting profile.