BITTER
IntrusionSet · ATTACK:enterprise:G1002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1002",
"title": "BITTER",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--7f848c02-4d1e-4808-a4ae-4670681370a9",
"external_id": "G1002",
"domain": "enterprise",
"created": "2022-06-01T20:26:53.880Z",
"modified": "2026-07-31T20:48:39.235Z",
"version": "1.1",
"aliases": [
"BITTER",
"T-APT-17"
],
"tactics": [
],
"source_references": [
{
"source_name": "T-APT-17"
},
{
"source_name": "Forcepoint BITTER Pakistan Oct 2016",
"url": "https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"
},
{
"source_name": "Cisco Talos Bitter Bangladesh May 2022",
"url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03c86a72-8298-4558-afc7-19cc09da4ff5
Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:S1013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0aa994e4-f1a3-4c14-b5e0-f2f6247d6630
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fc4c1db-001c-4b17-82c9-c55319a26534
Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13b6f054-5771-43ef-84df-b05ec9001f23
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24fadb92-7a18-450b-b4ca-f5dd019ce54c
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3efa9831-8d67-4bd1-92d4-ef252747b701
Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--445c926e-e0fb-4ac1-ba70-4ed45a68c592
Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bb228b7-a456-426a-9be0-68a8a8a1b2d0
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79192884-411c-490d-a28e-f923be7070e3
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81399eeb-a9f0-4e55-baed-2be3829962fe
DBAPPSecurity BITTER zero-day Feb 2021 · Microsoft CVE-2021-1732 Feb 2021ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--842c8968-1dab-46f9-838d-cb29d748fe5a
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85c85045-a030-435c-a353-6d89a1feacc0
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0994eea-4c0c-42d3-8d68-0acb1b6bb592
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d497a340-9b38-4b98-8fb6-1288519dc541
Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5e5a57a-e8cd-43c8-bc69-fa8bd40d82c0
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6997505-11ce-4ac3-ba26-b14f943b8a99
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7f27ed5-a90a-49c0-bd81-a10a98f77574
Forcepoint BITTER Pakistan Oct 2016