Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · HAZY TIGER · Unknown · assessed origin India · misp-galaxy + mitre-attack · refreshed 2026-10-06

HAZY TIGER

  • Bitter
  • T-APT-17
  • APT-C-08
  • Orange Yali
  • TA397

MITRE G1002 ↗

HAZY TIGER — ATT&CK roseHT

attack rose · 16 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.

Observed targets (as stated by the sources)

1 countries · 0 sectors
GermanyAssessed origin: India

assessed origin · Indiaobserved targets · 1

countries · 1

  • Germany

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

16 techniques · 6 of 15 tactics

  1. Resource development

    3 techniques

  2. Initial access

    1 technique

  3. Execution

    4 techniques

  4. Privilege escalation

    1 technique

  5. Stealth

    2 techniques

  6. Command and control

    5 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
ZxxZS1013 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016BITTER: A Targeted attack against PakistanForcepoint ↗

Take it with you

keyless · no signup

References

8 sources
  1. 1.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitep…
  2. 2.mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg
  3. 3.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/c…
  4. 4.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherh…
  5. 5.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-a…
  6. 6.attack.mitre.org/groups/G1002
  7. 7.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan
  8. 8.blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html

Track HAZY TIGER on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.