CVE Intelligence
Início / Grupos de ameaça / BITTER

BITTER G1002

🔔 Criar alerta

Também conhecido como: T-APT-17

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

5
CVEs associadas
18
Técnicas
1
Malwares e ferramentas

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-1732 Alta · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability
“BITTER has exploited CVE-2021-1732 for privilege escalation.”
CVE-2018-0802 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”
CVE-2018-0798 Alta · 8.8 KEV Microsoft Office Memory Corruption Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”
CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”
CVE-2012-0158 Alta · 8.8 KEV Ransomware Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
“BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.”

Técnicas por tática

Desenvolvimento de recursos
T1583.001 DomainsT1588.002 ToolT1608.001 Upload Malware
Acesso inicial
T1566.001 Spearphishing Attachment
Execução
T1053.005 Scheduled TaskT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistência
T1053.005 Scheduled Task
Escalada de privilégios
T1053.005 Scheduled TaskT1068 Exploitation for Privilege Escalation
Furtividade
T1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or Service
Comando e controle
T1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1568 Dynamic ResolutionT1573 Encrypted Channel

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.