HAZY TIGER is a threat actor active since 2014, known for custom RAT tools and targeted spearphishing attacks.
HAZY TIGER (also known as Bitter, T-APT-17) is a threat actor active since 2014, known for using custom RAT tools. The group currently targets victims in Germany. Their key TTPs include initial access via Spearphishing Attachment, execution through Dynamic Data Exchange (DDE), use of the ZxxZ (BitterRAT) malware, and Web Protocols for command and control. Defenders should enhance monitoring for DDE exploitation, scrutinize suspicious email attachments, and inspect web traffic for C2 anomalies.
The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.
Monitor for suspicious file uploads and tool acquisition activities.
Monitor for Spearphishing attempts with suspicious attachments and implement user awareness training.
Monitor and restrict suspicious file executions and Dynamic Data Exchange (DDE) usage.
Monitor for exploitation attempts that could lead to privilege escalation and implement proactive patch management.
Monitor for suspicious encrypted/encoded files and masqueraded tasks/services, and track anomalous system behavior.
Monitor for suspicious Web Protocols traffic and ingress tool transfers, and implement network segmentation and security controls.
They currently target victims located in Germany.
They use the ZxxZ (BitterRAT) malware.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.