CVE Intelligence
Home / Threat actors / BITTER

BITTER G1002

🔔 Create alert

Also known as: T-APT-17

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

5
associated CVEs
18
Techniques
1
Malware and tools

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-1732 High · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability
“BITTER has exploited CVE-2021-1732 for privilege escalation.”
CVE-2018-0802 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”
CVE-2018-0798 High · 8.8 KEV Microsoft Office Memory Corruption Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”
CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”
CVE-2012-0158 High · 8.8 KEV Ransomware Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”

Techniques by tactic

Resource Development
T1583.001 DomainsT1588.002 ToolT1608.001 Upload Malware
Initial Access
T1566.001 Spearphishing Attachment
Execution
T1053.005 Scheduled TaskT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistence
T1053.005 Scheduled Task
Privilege Escalation
T1053.005 Scheduled TaskT1068 Exploitation for Privilege Escalation
Stealth
T1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or Service
Command and Control
T1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1568 Dynamic ResolutionT1573 Encrypted Channel

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.