Procedure examples

BITTER has used a RAR SFX dropper to deliver malware.

BITTER has disguised malware as a Windows Security update service.

BITTER has used scheduled tasks for persistence and execution.

BITTER has exploited CVE-2021-1732 for privilege escalation.

BITTER has used HTTP POST requests for C2.

BITTER has used TCP for C2 communications.

BITTER has downloaded additional malware and tools onto a compromised host.

BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.

BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.

BITTER has used DDNS for C2 communications.

BITTER has encrypted their C2 communications.

BITTER has registered a variety of domains to host malicious payloads and for C2.

BITTER has obtained tools such as PuTTY for use in their operations.

BITTER has registered domains to stage payloads.