G1002 - BITTER

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has primarily targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.

Author
agomez
Created
2023-08-14 15:50:11
Last updated
2026-02-07 19:02:33
Downloads
300192
Hostname indicators
4
Sample indicators
32

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

e0d96c8065874d867ff58beffafea09f6095eb337eb7addfe3b75c8df61786d9 Sample

modified 2026-10-14 15:24:00
Bitter (Cyber Threat Alliance)

medzone71.com Hostname

modified 2026-10-14 15:24:00
Bitter (Cyber Threat Alliance)

kielsoservice.net Hostname

modified 2026-10-11 15:37:12
Bitter (Cyber Threat Alliance)

hewle.kielsoservice.net Hostname

modified 2026-10-11 15:37:12
Bitter (Cyber Threat Alliance)

9a8b201eb2bebe309d15c7b0ab5a6dcde460b84b035bb3575d4a0ec6af51a37e Sample

modified 2026-10-06 01:43:33
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

nx Sample

modified 2026-10-04 00:59:42
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

66a73b1b3b51a1c6a56db2d20cff9af3d1362b989989b5d9543d2e9b92ac9a3d Sample

modified 2026-09-18 05:14:11
Bitter (Maltiverse)

5aa0d7817105bea29bf56ccf62db63e2217719d192e1f7f66ae55922fb4c3725 Sample

modified 2026-09-03 04:01:20
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

hbfyewtuvfbhsbdjhjwebfy.net Hostname

modified 2026-07-16 13:54:53
Hazy Tiger (Maltiverse)

471b384ca81a9d804992d4e4693ab3d42d419a2e2690ebb146671407fe0809d8 Sample

modified 2026-07-10 00:42:07
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

drw Sample

modified 2026-06-28 07:58:21
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

Normal.dotm Sample

modified 2026-06-17 03:55:28
Generic Malware (Hybrid-Analysis) · Bitter (MalwareBazaar Abuse.ch)

15a58d7223761f8386c902ae2d55a1313b4744e543f8f228851d0376dce721fe Sample

modified 2026-04-21 03:01:08
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

14986da600df26fdb4e435cf01b6be4e5fffcc001059609070a2de701496bdde Sample

modified 2026-04-05 06:35:46
Generic Malware (Hybrid-Analysis) · Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

rftg.msi Sample

modified 2026-04-04 18:53:29
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

840e37db659cb1cf750c8bcc3e928b22173fdc3cb79d888502e30452be17c04e Sample

modified 2026-04-02 16:20:33
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

sk.msi Sample

modified 2026-03-26 05:21:27
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

9fd7522643ce8c67ed5ca7a58eba5451dc802cfc054c36f3cb89d073976c9676 Sample

modified 2026-03-05 06:17:54
Bitter (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

220fcfa47a11e7e3f179a96258a5bb69914c17e8ca7d0fdce44d13f1f3229548.apk Sample

modified 2026-01-28 00:35:00
Hazy Tiger (Maltiverse) · Generic.Malware (MalwareBazaar Abuse.ch)

212th_Confirm_Minutes.chm Sample

modified 2025-11-13 22:47:08
Bitter (MalwareBazaar Abuse.ch)

7f946eca44b547e643b57342b756ce1af5b3a0de1ce0b22eb9ac2b4e7e10e521 Sample

modified 2025-11-12 14:17:05
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

adccfea997a38c8245784cb9ddf22c4dc739539b4faac09e33acf8ab5a727bbd Sample

modified 2025-11-11 09:08:27
Hazy Tiger (Maltiverse)

4f237b5aa3ff4fc4e3014f693c27a1cba94fc24f3a6054c28d090592343c06a2 Sample

modified 2025-11-11 06:21:30
Hazy Tiger (Maltiverse)

Provision of Information for Sectoral for AJK.rar Sample

modified 2025-11-07 10:58:01
Bitter (MalwareBazaar Abuse.ch)

b200b34f29ea4b9b6965d7b696d07ac7e72bce49e19e3893817bbd9f15544ffe Sample

modified 2025-10-18 16:07:46
Hazy Tiger (Maltiverse)

Nominated Officials for the Conference.xlam Sample

modified 2025-10-18 12:28:17
Bitter (MalwareBazaar Abuse.ch) · Generic Malware (Cyber Threat Alliance)

vlcplayer.dll Sample

modified 2025-10-12 08:31:46
Bitter (MalwareBazaar Abuse.ch)

3fdf291e39e93305ebc9df19ba480ebd60845053b0b606a620bf482d0f09f4d3 Sample

modified 2025-10-10 13:00:09
Bitter (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

650f8f70149f12df57e7f82a6ae2967ac198588ae0c0ac8291925337a3cc544a.exe Sample

modified 2025-10-10 01:20:57
Hazy Tiger (Maltiverse) · Generic Malware (Hybrid-Analysis)

fc7229989aa3f9368f053f0a5f4d4e3bbb44b9ca7fa66e388413e288859c2642 Sample

modified 2023-01-21 18:46:14
Hazy Tiger (Maltiverse)

e99db1f69324b9eca0d8b30fd968656eb3cd56e3a45af690fa8750fb866f995a Sample

modified 2023-01-21 18:46:13
Hazy Tiger (Maltiverse)

846851fbd22db1f7fbbcff01ec0e03d4455aa00f7ed2d7c60825cc81fd253eda Sample

modified 2023-01-21 18:46:12
Hazy Tiger (Maltiverse)

79af6fc2d32b42845b38ba76576b15b290ad8db5e6697c4480b647a3ef312dd2 Sample

modified 2023-01-21 18:46:12
Hazy Tiger (Maltiverse)

594c625951cb21d969195dbc460cef3950b56935fac4843ecf76b6b82c789d83.exe Sample

modified 2023-01-21 18:46:11
Hazy Tiger (Maltiverse) · Generic Malware (Hybrid-Analysis)

41e8adc62dbe14d0364cb5d0db169d2bab52757912bd44a7da6da987dd09b0bd Sample

modified 2023-01-21 18:46:10
Hazy Tiger (Maltiverse)

53713a382ac6b8e08023ea10863651eeae777180c52dcd058df59a3f81b76105 Sample

modified 2023-01-21 18:46:09
Hazy Tiger (Maltiverse)