BITTER (TA397)

South Asian espionage group, assessed by vendors as Indian, phishing governments, diplomats, defense and energy targets since 2013 with home-grown RATs and Android spyware.

Threat actor profile · Updated Nov 4, 2026

Active: 2013 to November 2026
Origin: India (vendor assessment: Proofpoint and Threatray; no government attribution)
Type: State-sponsored
Affiliates: Tool overlap (ORPCBackdoor) with Confucius and Mysterious Elephant (APT-K-47), per Proofpoint; possible hack-for-hire offshoot behind ProSpy, per Lookout
Regions targeted: Pakistan, Bangladesh, China, Saudi Arabia, Turkey, Europe, South Korea, South America, India, New Zealand, United Kingdom, Egypt, Lebanon, Bahrain, United Arab Emirates
MITRE ATT&CK: G1002

What each vendor calls it

CrowdStrike: HAZY TIGER
Proofpoint: TA397
Cisco Talos: T-APT-17

Also known as APT-C-08 Qihoo 360Orange Yali

See this actor in the Threat Actor Rosetta Stone →

Profile

BITTER is a long-running espionage group focused on South Asia and on the governments around it. Forcepoint gave it the name in an October 2016 report, after the network header its newest remote access trojan used, and traced the activity back to at least November 2013. MITRE ATT&CK describes it as a suspected South Asian group that has gone after government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia. Proofpoint tracks it as TA397, CrowdStrike as HAZY TIGER, Cisco Talos as T-APT-17, Qihoo 360 as APT-C-08 and QiAnXin as APT-Q-37.

No government has publicly attributed BITTER. The link to India is a vendor assessment, and for years it was asserted more than argued. In June 2025 Proofpoint and Threatray tried to fix that in a joint two-part study, concluding it is highly likely that TA397 is a state-backed actor collecting intelligence for the Indian state. Their evidence: operators answered infected machines and built infrastructure during Monday-to-Friday office hours in Indian Standard Time, across timestamps for 122 of the group’s domains; lures showed familiarity with the government bodies of India’s neighbors; and the custom ORPCBackdoor implant has also turned up with Mysterious Elephant (APT-K-47) and Confucius, two other groups vendors tie to India. Proofpoint frames that overlap as a possible tool-sharing ecosystem, and says more research is needed to know whether the groups share a central developer. Earlier vendor reports, such as Cisco Talos in 2022, stopped at “suspected South Asian”.

The way in barely changes. It is almost always a spearphishing email, often sent from a compromised government mailbox or a free account dressed up as an embassy, carrying an archive or attachment that plants a T1053.005 (Scheduled Task/Job: Scheduled Task). That task checks in with a PHP page on a staging domain on a short timer (every 15 to 19 minutes in Proofpoint’s and Intezer’s recent cases), sending the computer and user name, and waits. Payloads only arrive when an operator decides the victim is worth it: Proofpoint watched operators reply by hand roughly 12 hours after the first beacon in one case, and Intezer saw the servers hand out empty MSI files first, which looks like victim screening. The delivery wrapper is what changes. Early campaigns relied on old Office bugs (CVE-2012-0158, then the Equation Editor flaws CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802). Later ones moved to T1218.001 (System Binary Proxy Execution: Compiled HTML File) lures, shortcut files hiding PowerShell in NTFS alternate data streams, Microsoft Management Console files abusing GrimResource (CVE-2024-43572), and in 2025 Excel add-ins that compile a C# backdoor on the victim’s own machine.

The malware is home-grown and deliberately plain. Threatray’s catalog of the arsenal runs from ArtraDownloader and the WSCSPL backdoor (2016) through BDarkRAT (2019, likely derived from the open-source DarkAgentRAT), the ZxxZ downloader that Threatray calls MuuyDownloader (2021), AlmondRAT, WmRAT and ORPCBackdoor (2022), to MiyaRAT, the KiwiStealer file stealer and the KugelBlitz loader that Proofpoint saw deploying the open-source Havoc framework (2024). Shared coding habits point to one developer pool, and several families were still being updated in 2025. The group has also leaned on Windows privilege escalation zero-days: Kaspersky credits DBAppSecurity with finding BITTER using CVE-2021-1732 and says a second zero-day, CVE-2021-28310, is believed linked to the same actor.

Mobile spying has been part of the toolkit almost from the start. Bitdefender dates the first BITTER Android implants, built on AndroRAT, to 2014, and Forcepoint found them disguised as Islamic prayer-time and Kashmir news apps. In 2022 Meta said BITTER posed as attractive young women, journalists and activists to build trust with targets in New Zealand, India, Pakistan and the UK, offered an iOS chat app through Apple’s TestFlight, and pushed a new Android family, Dracarys, inside trojanized copies of YouTube, Signal, Telegram and WhatsApp.

Two shifts stand out in recent reporting. First, the target list has widened from Pakistan, Bangladesh and China toward diplomats and defense organizations in Europe, Turkey, East Asia and South America, with lures pinned to the news of the day, such as South Korea’s December 2024 martial law declaration. Second, in April 2026 Lookout, working with Access Now and SMEX, tied a campaign against journalists, activists and opposition figures in the Middle East to BITTER through code overlap between the ProSpy Android spyware and Dracarys. Lookout’s assessment is moderate confidence, and it calls the operation likely hack-for-hire: it cannot say whether BITTER itself expanded into civil society targeting or whether an unknown hack-for-hire outfit shares its tooling. ESET, which first documented ProSpy in October 2025, did not name an actor.

Events

Date	Target	Narrative	Source	Our coverage
2026-11	South Asian organizations; lures aimed at diplomatic and military staff	Fortinet reports PapRAT, a new C++ and Rust remote access tool, spread through three chains dressed as diplomatic paperwork. One uses a shortcut that makes ftp.exe run a disguised script and pipe commands into cmd (T1202 (Indirect Command Execution)), then schedules curl beacons; the others install PapRAT through a fake Microsoft MSI (T1218.007 (System Binary Proxy Execution: Msiexec)), and one chain also fetched WmRAT.	Fortinet FortiGuard Labs	Our story
2026-04	Journalists, activists and opposition figures in Egypt and Lebanon; likely targets in Bahrain, the UAE, Saudi Arabia and the UK	Lookout, with Access Now and SMEX, links a hack-for-hire operation to BITTER with moderate confidence. Lures included fake Signal “link device” QR pages, Apple Support iMessages leading to iCloud phishing, and fake Signal, ToTok and Botim apps carrying ProSpy, whose code closely tracks BITTER’s 2022 Dracarys. Samples span August 2024 to March 2026.	Lookout
2025-10	Not disclosed; lure referenced Azad Jammu and Kashmir	QiAnXin reports two chains ending in the same C# backdoor: an Excel add-in whose macro writes C# source and compiles it with csc.exe and InstallUtil (T1027.004 (Obfuscated Files or Information: Compile After Delivery)), and a RAR archive abusing a WinRAR path traversal bug to overwrite Word’s Normal.dotm (T1137.001 (Office Application Startup: Office Template Macros)). QiAnXin found the bug worked on WinRAR 7.11 but not 7.12, so it was not CVE-2025-8088.	QiAnXin
2025-02	Not disclosed	Email made to look like an existing thread carries a RAR with a CHM file that creates a scheduled task. After enumerating the machine, an operator hand-delivers BDarkRAT about 43 minutes later.	Proofpoint
2024-12	Turkish and Chinese entities with a presence in Europe; diplomatic recipients	Lures pose as the embassies of Mauritius and Madagascar, and one rides South Korea’s martial law crisis with a fake “Seoul Embassy Advisory”. Other spoofed senders include Chinese government bodies, South Korea’s foreign ministry and Pakistan’s embassy in Beijing.	Proofpoint
2024-12	Government organizations	A Microsoft Search Connector file drops a shortcut that sets up a scheduled task; operators answer during Indian office hours, deploy the KugelBlitz loader and a Havoc agent, then mount an SMB share to run WmRAT and MiyaRAT. The share also held scanned Bangladeshi tax and military documents Proofpoint judges highly likely stolen from victims.	Proofpoint
2024-11	Turkish defense sector organization	Email from a compromised government account, themed on World Bank road projects in Madagascar. A shortcut posing as a PDF runs PowerShell hidden in an alternate data stream (T1564.004 (Hide Artifacts: NTFS File Attributes)), creates a “DsSvcCleanup” task beaconing every 17 minutes, and operators later install WmRAT and MiyaRAT through MSI files (T1218.007 (System Binary Proxy Execution: Msiexec)).	Proofpoint
2024-10	Not disclosed	First use of a Management Console file inside a RAR archive, exploiting GrimResource (CVE-2024-43572) so mmc.exe creates a scheduled task and runs a PowerShell download (T1218.014 (System Binary Proxy Execution: MMC)).	Proofpoint
2023-03	Chinese nuclear energy organizations and nuclear academics	At least seven emails posing as Kyrgyzstan’s embassy in Beijing invite recipients to conferences; RAR archives carry CHM or Equation Editor Excel files that create scheduled tasks fetching MSI payloads. Intezer attributes on overlapping tactics.	Intezer
2022-08	People in New Zealand, India, Pakistan and the UK	Meta disrupts BITTER on its platforms: fake personas of young women, journalists and activists; an iOS chat app via TestFlight; and Dracarys, new Android malware inside trojanized YouTube, Signal, Telegram and WhatsApp that abused accessibility services to grant itself permissions.	Meta
2021-08 to 2022-05	Senior officers of Bangladesh’s Rapid Action Battalion	Emails spoofing Pakistani government senders carry RTF and Excel files exploiting CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802, which drop the ZxxZ downloader disguised as a Windows Security update service (T1036.004 (Masquerading: Masquerade Task or Service)). Talos attributes to BITTER with moderate confidence.	Cisco Talos
2021-04	Not disclosed	Kaspersky finds the Desktop Window Manager zero-day CVE-2021-28310 in use and says it believes it is linked to BITTER (T1068 (Exploitation for Privilege Escalation)).	Kaspersky
2021-02	Not disclosed	The Win32k privilege escalation zero-day CVE-2021-1732, discovered by DBAppSecurity, is reported in use by BITTER.	Kaspersky (citing DBAppSecurity)
2018-09 to 2019-01	Pakistani government and an engineering company; organizations in Saudi Arabia and China	About 80 ArtraDownloader samples in three variants, delivered via CVE-2017-11882 documents and used to install BitterRAT. Unit 42 calls it the first reported BITTER targeting of Saudi Arabia.	Unit 42
2016-10	Pakistani government staff and nationals	Forcepoint names BITTER: spearphishing with CVE-2012-0158 Word and Excel files (T1566.001 (Phishing: Spearphishing Attachment)), a custom Windows RAT, and AndroRAT variants posing as prayer-time and Kashmir news apps.	Forcepoint
2014	Android users (Pakistan focus)	First BITTER Android implants, built on the AndroRAT framework; the group later moved to a custom tool Bitdefender calls BitterRAT.	Bitdefender
2013-11	Not disclosed	Earliest activity Forcepoint traced for the campaign.	Forcepoint

Target vectors risk profile

Government	Diplomatic	Defense	Espionage	Energy	Media/journalists	Dissidents/NGOs	Education/research	Telecom	Finance	Ransomware/extortion
High	High	High	High	High	Medium	Medium	Medium	Low	Low	N/A

Malware and tools

Name	What it does	Public detection	Hunt Leads	Reports
PapRAT	C++ and Rust RAT posing as Microsoft redistributables; shell, file transfer, run, delete, drive listing and screenshots over HTTP or HTTPS	Indicators in Fortinet’s report	4 Hunt Leads	Fortinet
WmRAT	C++ RAT for screenshots, file theft and cmd/PowerShell execution, padded with junk threads	YARA rule in Threatray’s report; IOCs in Threatray’s GitHub		Proofpoint, Threatray
MiyaRAT	Newer C++ RAT with reverse shells, file transfer and screenshots; Proofpoint thinks it may be kept for high-value targets	YARA rule in Threatray’s report		Proofpoint, Threatray
BDarkRAT	.NET RAT with shell, file management, screen capture and PowerShell, likely derived from open-source DarkAgentRAT	YARA rule in Threatray’s report		Threatray
ZxxZ (MuuyDownloader)	C++ downloader that fetches payloads with the first PE byte stripped and checks for Defender and Kaspersky	YARA rule in Threatray’s report		Cisco Talos, MITRE ATT&CK
ORPCBackdoor	C++ backdoor using RPC for command and control; also seen with Mysterious Elephant and Confucius	YARA rule in Threatray’s report		Threatray
AlmondRAT	.NET RAT for directory listing, file transfer and shell commands	YARA rule in Threatray’s report		Threatray
KugelBlitz and Havoc	Shellcode loader used to run a Havoc command-and-control agent	YARA rule in Threatray’s report		Proofpoint
KiwiStealer	File stealer that grabs recently modified documents and archives under 50 MB	YARA rule in Threatray’s report		Threatray
ArtraDownloader	C++ downloader that profiles the victim and installs BitterRAT; three variants	YARA rule in Threatray’s report		Unit 42
WSCSPL and BitterRAT	Early backdoor family for system profiling, file download and remote commands	YARA rule in Threatray’s report		Threatray, Forcepoint
C# backdoor (vlcplayer.dll, winnsc.exe)	Compiled on the victim’s machine or dropped via a poisoned Word template; downloads and runs further EXE files	IOCs in QiAnXin’s report		QiAnXin
Dracarys (Android)	Spyware in trojanized messaging and YouTube apps: calls, contacts, texts, location, camera and microphone	Indicators in Meta’s report		Meta
ProSpy (Android)	Kotlin spyware posing as Signal, ToTok and Botim; steals contacts, SMS, device data and files	Indicators in Lookout’s report		Lookout, ESET
AndroRAT variants	Open-source Android RAT for contacts, call logs, messages, location, photos and audio	None published		Bitdefender

Reports

Date	Source	Report
2026-11-02	Fortinet FortiGuard Labs	BITTER Expands Its Arsenal with PapRAT
2026-04-08	Lookout	Beyond BITTER: MENA civil society targeted in hack-for-hire operation linked to BITTER APT
2025-10	QiAnXin	Bitter (APT-Q-37) uses diverse means to deliver new backdoor components
2025-10-02	ESET	New spyware posing as messaging apps targeting users in the UAE (ProSpy, no actor named)
2025-06-05	The Record	New evidence links long-running hacking group to Indian government
2025-06-04	Threatray and Proofpoint	The Bitter End: Unraveling eight years of espionage antics, part two
2025-06-04	Proofpoint and Threatray	The Bitter End: Unraveling eight years of espionage antics, part one
2024-12-17	Proofpoint	Hidden in plain sight: TA397’s new attack chain delivers espionage RATs
2023-03-24	Intezer	Phishing campaign targets Chinese nuclear energy industry
2022-08	Meta	Quarterly Adversarial Threat Report, Q2 2022
2022-05-11	Cisco Talos	Bitter APT adds Bangladesh to their targets
2021-04-13	Kaspersky	Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild
2020-06-18	Bitdefender	BitterAPT revisited: the untold evolution of an Android espionage tool
2019-02-25	Unit 42	Multiple ArtraDownloader variants used by BITTER to target Pakistan
2016-10-21	Forcepoint	BITTER: a targeted attack against Pakistan
Ongoing	MITRE ATT&CK	BITTER, G1002

Vulnerabilities exploited

Vulnerability	CVSS	Severity	Publisher	Platform	CISA KEV
CVE-2024-43572	7.8 (Microsoft, CNA; no NVD score)	High	Microsoft	Microsoft Management Console (GrimResource)	Yes
CVE-2021-28310	7.8	High	Microsoft	Windows Desktop Window Manager (Win32k)	Yes
CVE-2021-1732	7.8	High	Microsoft	Windows Win32k	Yes
CVE-2018-0802	7.8	High	Microsoft	Office Equation Editor	Yes
CVE-2018-0798	8.8	High	Microsoft	Office Equation Editor	Yes
CVE-2017-11882	7.8	High	Microsoft	Office Equation Editor	Yes
CVE-2012-0158	8.8	High	Microsoft	Office (MSCOMCTL.OCX common controls)	Yes

If you’re in their sights

Do this now

Block or quarantine the file types this group mails in archives: CHM, MSC, LNK, IQY, Access databases and Excel add-ins (.xlam). Few users need to receive any of them by email, and unpacking RAR files is where its chains start.
Patch Office and WinRAR, and remove the legacy Equation Editor. The group was still sending Equation Editor exploits years after the 2017 and 2018 fixes, and in 2025 it abused an older WinRAR path traversal bug that version 7.12 closes.
Hunt for new scheduled tasks that run curl, PowerShell or msiexec every few minutes, and for web requests to PHP pages that carry the computer and user name in the URL. That beacon is the group’s most consistent fingerprint.
Alert when a user’s Normal.dotm template changes, or when csc.exe and InstallUtil.exe run from Office or a script. Both showed up in the 2025 C# backdoor chains.
For journalists and staff in the Middle East: install apps only from official stores, never scan a QR code to “link” a Signal device unless you started it yourself, and review Signal’s linked devices list regularly.

Compiled from Proofpoint, Threatray, Lookout, QiAnXin, Cisco Talos, Kaspersky, Meta, Intezer, Unit 42, Bitdefender, Forcepoint, ESET and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 3, 2026.