BITTER
aka TA397, T-APT-17, APT-C-08, Hazy Tiger
A spy group suspected to be based in South Asia that targets Pakistan, China, Bangladesh and others, including Turkey's defense industry. It gets in with archives disguised as ordinary documents.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Suspected South Asian cyber espionage group — MITRE ATT&CK
- Assessed TA397 (BITTER) as likely South Asia-based, partly from its working hours — Proofpoint
How they attack
Entry
Shortcuts disguised as documents
Like a box labeled 'report' that starts copying your house keys the moment you open it.
Entry
Targeted phishing emails
Like a letter that seems to come from a colleague, with an envelope that springs a trap when opened.
Goal
Long-term spying
Like leaving a tiny bug in the meeting room and listening in for months.
Recent articles
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily