BITTER

Names and who uses them

• BITTEROur name
• T-APT-17Cisco Talos

Targets

Sectors: Government, Energy

Regions: Saudi Arabia

Known techniques

• T1027.013Encrypted/Encoded File
• T1036.004Masquerade Task or Service
• T1053.005Scheduled Task
• T1068Exploitation for Privilege Escalation
• T1071.001Web Protocols
• T1095Non-Application Layer Protocol
• T1105Ingress Tool Transfer
• T1203Exploitation for Client Execution
• T1204.002Malicious File
• T1559.002Dynamic Data Exchange
• T1566.001Spearphishing Attachment
• T1568Dynamic Resolution
• T1573Encrypted Channel
• T1583.001Domains
• T1588.002Tool
• T1608.001Upload Malware

Malware and tools used