Bitter APT Expands Cyberespionage Campaigns with Sophisticated Tools and Targets The advanced persistent threat (APT) group Bitter (also known as TA397, APT-C-08, Orange Yali, and Hazy Tiger), linked to the Indian government, has intensified its cyberespionage operations. According to a joint analysis by Proofpoint and Threatray, the group has launched spear-phishing attacks impersonating government and diplomatic entities from Bangladesh, Pakistan, China, and South Korea, aiming to deploy malicious payloads. Bitter’s recent campaigns have leveraged multiple tools, including: - KugelBlitz and BDarkRAT payloads for system compromise. - ArtraDownloader, which deploys the WSCSPL backdoor for system data exfiltration. - Almond RAT and MuuyDownloader trojans for remote access and persistence. - ORPCBackdoor, previously associated with the Mysterious Elephant threat actor—another group tied to Indian APTs SideWinder and Confucius. - KiwiStealer, an information-stealing malware designed to harvest sensitive data. The findings highlight Bitter’s evolving tactics, combining social engineering with a diverse arsenal of malware to conduct targeted espionage. The group’s infrastructure and toolset suggest continued alignment with state-sponsored objectives.