Bitter

Overview

Trojan:Win32/Bitter refers to malware associated with the **Bitter APT group**, an Advanced Persistent Threat actor operating out of South Asia. They primarily target government, military, and energy organizations in neighboring countries (like Pakistan and China) for espionage and data theft. The 'Bitter' malware family encompasses the custom Remote Access Trojans (RATs) and downloaders used by this group.

Understanding the Bitter APT
To an end-user, the infection is invisible, often starting with a highly targeted spearphishing email. For a SOC analyst, detecting Bitter malware is a major incident indicating a state-sponsored or highly organized espionage campaign targeting the organization's intellectual property or sensitive communications.

Execution and Espionage Mechanics
Bitter typically gains initial access via Spearphishing Attachments (`T1566.001`), often exploiting known vulnerabilities (like CVE-2012-0158 or CVE-2017-11882) in Microsoft Office documents (Equation Editor). Upon successful exploitation, it drops a custom downloader that retrieves the secondary payload (often a RAT) from compromised infrastructure. The RAT establishes persistence, usually via Registry Run keys or Startup folders (`T1547.001`), and begins collecting system information, capturing keystrokes, and exfiltrating targeted files to the C2 server.

Indicators of Compromise & Impact
The primary impact is the long-term, stealthy exfiltration of highly sensitive data. Host-based IoCs include the presence of malicious Office documents in user profiles, unexpected executables in `%AppData%` or `%LocalAppData%`, and registry modifications for persistence. Network IoCs involve outbound connections to known Bitter C2 IP addresses or domains, often using custom protocols or HTTP POST requests to exfiltrate data.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BITTER {
    meta:
        description = "Detects Bitter (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bitter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bitter Activity
id: 1d6ad39ff8ff378c5e23ef5921065891
status: experimental
description: Detects generic indicators of the bitter malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bitter*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the infected endpoint and any other machines that the user recently communicated with.
2. Analyze the initial spearphishing email to identify the sender, subject, and attachment hash, and block them at the email gateway.
3. Identify the C2 infrastructure used by the Bitter malware and block all outbound traffic to those IPs/domains.
4. Perform a comprehensive forensic investigation to determine exactly what files or data were accessed and exfiltrated.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is a random, opportunistic infection; APT groups like Bitter are highly targeted and persistent.
2. Avoid wiping the machine immediately; preserve evidence to understand the scope of the espionage.

References & External Analysis

• Search "bitter" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Qhosts
• Streespyer
• Vstoolbar
• Attack
• Emgfamt7Gjgi

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/bitter.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.