BITTER
- ID
- G1002
- Associated names
- T-APT-17
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.[1][2]
Techniques used (16)
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1053.005 Scheduled Task
- T1068 Exploitation for Privilege Escalation
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1559.002 Dynamic Data Exchange
- T1566.001 Spearphishing Attachment
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1583.001 Domains
- T1588.002 Tool
- T1608.001 Upload Malware