H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ZxxZ](https://attack.mitre.org/software/S1013) is a trojan written in Visual C++ that has been used by [BITTER](https://attack.mitre.org/groups/G1002) since at least August 2021, including against Bangladeshi government personnel.(Citation: Cisco Talos Bitter Bangladesh May 2022)

Labels

malware

15 recorded

Relationships

uses

Group

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Masquerade Task or Service

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

2 external

References

mitre-attack

S1013

Cisco Talos Bitter Bangladesh May 2022

https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html