HAZY TIGER
BitterT-APT-17APT-C-08Orange YaliTA397
The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since. Source: MISP
Attributed country: IN according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 9 Nov 2026 · last seen on 9 Nov 2026
News
- Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South AsiaThe Hacker News · 9 Nov 2026
MITRE ATT&CK techniques
Resource Development
Initial Access
Execution
T1053.005Scheduled Task 40 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1559.002Dynamic Data Exchange 1 Sigma rules
Privilege Escalation
Command and Control
T1071.001Web Protocols 39 Sigma rulesT1095Non-Application Layer Protocol 3 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1568Dynamic Resolution 4 Sigma rulesT1573Encrypted Channel 5 Sigma rules
Stealth
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗