Bitter
Bitter is a Pakistan-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 20 countries, including the United Kingdom and India. It uses 69 MITRE ATT&CK techniques and exploits 16 known CVEs.
- T-APT-17
- HAZY TIGER
- Orange Yali
- TA397
- G1002
- TA397(Bitter)
- Origin
- Pakistan
- Techniques
- 69
- Exploited CVEs
- 16
- First seen
- Dec 4, 2025
- Last seen
- Dec 4, 2025
- Record updated
Who They Target.
About Bitter.
Forcepoint Security Labs recently encountered a strain of attacks that appear to target Pakistani nationals. We named the attack “BITTER” based on the network communication header used by the latest variant of remote access tool (RAT) used. Our investigation indicates that the campaign has existed since at least November 2013 but has remained active until today.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.