H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)

17 recorded

Relationships

uses

Technique

uses

to Dynamic Data Exchange

Technique

uses

to Dynamic Resolution

Technique

uses

to Encrypted Channel

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Masquerade Task or Service

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Scheduled Task

Technique

uses

to Spearphishing Attachment

Technique

uses

Technique

uses

to Upload Malware

Technique

uses

to Web Protocols

Technique

uses

Malware

4 external

References

mitre-attack

G1002

T-APT-17

—

Forcepoint BITTER Pakistan Oct 2016

https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan

Cisco Talos Bitter Bangladesh May 2022

https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html