{
  "name": "Strike Ready: Introducing the Bitter APT Group",
  "slug": "strike-ready-introducing-the-bitter-apt-group",
  "description": "The report provides an in-depth analysis of the Bitter APT Group, a threat actor primarily focusing on cyber espionage activities in South Asia. It details the group's tactics, techniques, and procedures, including their ability to bypass security technologies by leveraging obscure file formats and encrypted payloads. The report examines various malware samples, backdoors, and information stealers utilized by the group, shedding light on their capabilities and methods of operation. Additionally, it provides indicators of compromise, YARA rules, and recommendations for defending against these persistent threats.",
  "published": "2024-08-19T11:35:43+00:00",
  "created_at": "2024-08-19T11:35:43+00:00",
  "modified_at": "2024-08-19T11:59:32+00:00",
  "created_at_opencti": "2024-08-19T11:35:43+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-08-19",
    "backdoors",
    "espionage",
    "figlio.exe",
    "infostealers",
    "olmapi32.dll",
    "orpcbackdoor",
    "payloads",
    "persistence",
    "schs.exe",
    "scm.exe",
    "searchapp.jpg",
    "sparrow.jpg",
    "sstn.exe",
    "stom.jpg"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "91.132.93.235"
      },
      {
        "id": "",
        "name": "176.124.33.42"
      },
      {
        "id": "",
        "name": "172.86.68.175"
      },
      {
        "id": "",
        "name": "https://oraclewebonline.com/log.php?computername="
      },
      {
        "id": "",
        "name": "https://oraclewebonline.com/log.php."
      },
      {
        "id": "",
        "name": "https://bickrickneoservice.com/Z/CERTga.msi"
      },
      {
        "id": "",
        "name": "http://bickrickneoservice.com/Z/mrcvs.exe"
      },
      {
        "id": "",
        "name": "http://172.86.68.175:4443/upload"
      },
      {
        "id": "",
        "name": "http://172.86.68.175"
      },
      {
        "id": "",
        "name": "microsoft.officeweb.live"
      },
      {
        "id": "",
        "name": "windowphotoviewer.com"
      },
      {
        "id": "",
        "name": "pdcunaco.com"
      },
      {
        "id": "",
        "name": "oraclewebonline.com"
      },
      {
        "id": "",
        "name": "libreofficeonline.com"
      },
      {
        "id": "",
        "name": "kimfilippovision.com"
      },
      {
        "id": "",
        "name": "evtessentials.com"
      },
      {
        "id": "",
        "name": "bickrickneoservice.com"
      },
      {
        "id": "",
        "name": "outlook-web.ddns.net"
      },
      {
        "id": "",
        "name": "ff372dc759f9ec71dc3ae80082d5b125dfe1e1e23c774a09e5b0cef7e5ed67b8"
      },
      {
        "id": "",
        "name": "f92e1083eae5d4536c974fc0ca1595cf33a0c159d4d7ca8b368891930f1889e0"
      },
      {
        "id": "",
        "name": "ee088e6d8ac0f3dbfbd17f556a58d06cc882016fd8a4a8ba2ddcd0cab5322d23"
      },
      {
        "id": "",
        "name": "f7352581613aeb9d6ce6f21814b72d389377201eeceac3b58e9d1ba6469e69dc"
      },
      {
        "id": "",
        "name": "dcc94bfd52680b32e2c0b9b4705c71cecef9285ee454e3c51b07070d1755b580"
      },
      {
        "id": "",
        "name": "d99831e1c67b6251f5fd86393a70cc3a731e5ffda4f7bf926f256c581f73fb38"
      },
      {
        "id": "",
        "name": "d9ca0a9fcf6458ce310c234410a27bc1e50eb51e41e29434c5ef1182f556d3ba"
      },
      {
        "id": "",
        "name": "d69ba74e4712cd7c883fdadfd5badf769f8ec887f9a7ad9fba44fd75b78eaeac"
      },
      {
        "id": "",
        "name": "d3cfd8ff93a2d7662081a5cb521c10f56d2bcee9e68d51d986b4a5496a3827c3"
      },
      {
        "id": "",
        "name": "d5b7522575f56185eb5c3759e091569e53318add9ceb34705a5c63e49736ca6b"
      },
      {
        "id": "",
        "name": "cd8c8b832435f2254069bc587ec7650aa4b404e12b6afa3044dc81a5b5a83fc7"
      },
      {
        "id": "",
        "name": "cb5a3801f64c9deab4b0ffc0aa7a7f437addb0f407d7a9b3dccd0446304e4c38"
      },
      {
        "id": "",
        "name": "cb2653260502c16962ceaf7b0b77ba9799ffb68324e38dba653413a0828f8021"
      },
      {
        "id": "",
        "name": "c4509c789f6460047d6fee4621601f952a6a10f840f8e05f15b618163e0bf18f"
      },
      {
        "id": "",
        "name": "ba352569428df4618cd57f91bd3479b73a798399a6b861ed996d715bc51e916c"
      },
      {
        "id": "",
        "name": "b907006efec8585e67b48e843c8fee68d9c6132ad6cb9dd2da7864220d98d2fc"
      },
      {
        "id": "",
        "name": "b8beb5e27fc339772b63ed454ec054a16b554e5c354eab8de7b4addbe238f403"
      },
      {
        "id": "",
        "name": "ae61ef6e864c75cf0761f0f645563ed467d9a9fc34284e20dc32acd420703468"
      },
      {
        "id": "",
        "name": "a73f2394d27bd41f66b0822efab069683b6969942e90944d1a8ff60416fa7cfa"
      },
      {
        "id": "",
        "name": "a1bb8ce0cf7290524326442be9b8ecce883d860f6437dcc4bc64b99f72004fdd"
      },
      {
        "id": "",
        "name": "a00f37c28ed4704a7b6a2a27f86baf9a7e23a0cb12dd9f5a59ffc9bcee84e2bc"
      },
      {
        "id": "",
        "name": "9ffb61f1360595fc707053620f3751cb76c83e67835a915ccd3cbff13cf97bed"
      },
      {
        "id": "",
        "name": "9e681830cc1835e8041ee578fdd8cffe94ee91c92e946b73e7270787caacc296"
      },
      {
        "id": "",
        "name": "98ad6b039b489dbd6325baaf1b2405c4f1399fd52eeddf77af8ea73196d069b7"
      },
      {
        "id": "",
        "name": "95237e4179f0385cb400ace3835d5f1382c3f16944d4e76a0a829f9ca41442d9"
      },
      {
        "id": "",
        "name": "94cd0c50f1cd9cd0e5e137e765dc8306793624a94584415ad71473eeed98401f"
      },
      {
        "id": "",
        "name": "935dd2793ea9bfdf8bb5e52b51b81cd541cf4a752a3fe0abae939a2b0a12f731"
      },
      {
        "id": "",
        "name": "8730deaca1e593da1a13389945f8a6a9e126a4a9f8304ae90cbbc95171bcd4db"
      },
      {
        "id": "",
        "name": "86376d909ab4ff020a9b0477f17efeee736cf1eb2020ded3c511188f8571ebc5"
      },
      {
        "id": "",
        "name": "85542438303e4974917ee2ef3e984d9ba9b3e731ddcf2b7626d0fad65b252a0b"
      },
      {
        "id": "",
        "name": "7eb0d740674ac24156a8ee66a660d67ff7505d1552c14b203b39331cea7a547e"
      },
      {
        "id": "",
        "name": "7059e92102cc8bc02b3b426bc46d030e616e37c40373f9610289bd63a8e40db1"
      },
      {
        "id": "",
        "name": "700827a157a3c3ddd1a4ac80b98d4519d937f240ec9046d1e9c3a480024c8ccd"
      },
      {
        "id": "",
        "name": "6cdc79edba95c6a9ec1d50457dc16f40f02c46a7d0b9665f099abe8155d1a25c"
      },
      {
        "id": "",
        "name": "6b3c1e7cb7c4155611f04c7715162f5ecf141d18e61c87df2454da3ef9c52644"
      },
      {
        "id": "",
        "name": "52a4020392de0d527fe0aaf551fa557628c68419415b86afa36854d0bc987d9d"
      },
      {
        "id": "",
        "name": "51380ab46e6fc0b3449ea1b86d0f746cf5b001700c0910c7a920b94021a6f2b3"
      },
      {
        "id": "",
        "name": "4827c3d73576bce406e89cf07aa671e1937efb89b012460b1831ac1c07574c59"
      },
      {
        "id": "",
        "name": "4798e79597fbde0059c2e2be04d8ac5801bbbb75bcef9a75d2811d8ef033513d"
      },
      {
        "id": "",
        "name": "455163bfa49326fb7787af85cb0decc84100533da38bbdcbf06b2bdb6f7f521a"
      },
      {
        "id": "",
        "name": "4403650cc38298ae5149155d4040ba438ae58764471a7ec1472ebe3e51e14b86"
      },
      {
        "id": "",
        "name": "3d3f42e0e9c0c1db2089fb87ab34f366b8ac192e0acdd0ae2e190b96fa9578d0"
      },
      {
        "id": "",
        "name": "3bd8d3d9fd594a37cc8cb9838e528ca6d9acd2f6bbe4e95ff51d9f35fdde2e13"
      },
      {
        "id": "",
        "name": "342b9b6c9117d0769eb3b8efa438860e5481ffa3b694db7ee8a772ff7ec9020c"
      },
      {
        "id": "",
        "name": "311f38b7836c4228463d6464f854761b7cc8c6071b5f9731b6377df5d7d0ea89"
      },
      {
        "id": "",
        "name": "2ffb061af36193a447c9932cbe6abff0fc98414710bfb5151af234861b09ff1f"
      },
      {
        "id": "",
        "name": "2fc55a335fd040cf8fefbb48344ccae2c71cb51ababf2963c655f9e675eb7335"
      },
      {
        "id": "",
        "name": "2cd43763e992a0127e91efe5bb4749c66bcf215f31133ce6388a8170c8f8a7f6"
      },
      {
        "id": "",
        "name": "2ba0effa66c01a5dd8f04c83b6f9bada991e3323f7fb5fe365427256e9c6c624"
      },
      {
        "id": "",
        "name": "2a4cd85fc8f0bd5b399cd0cea6bc0cdea3174e1608fd5679860be8e2a78a8903"
      },
      {
        "id": "",
        "name": "2a3519501362a44a4b122fbf869e195989741525883f07d0fc2d2e5e48fb7fff"
      },
      {
        "id": "",
        "name": "21e73214b7b38055600c4c492c537cba78141e292330d9af689fa28a65a683e0"
      },
      {
        "id": "",
        "name": "1c089e89b341ce7d506e6d5c60e7efcaccb068c20dbfc6f23995563ad1eb28e9"
      },
      {
        "id": "",
        "name": "167737e5c072a1ea05a7c0fcaa3f190cfd6708b3bd87c0da54f9e8d9c55fd714"
      },
      {
        "id": "",
        "name": "12c7cf50d634ecc0fc0ebdd547f35cdfe35ba60488c11d17e4767a28e4bd0eab"
      },
      {
        "id": "",
        "name": "10b82939733df349b91fe06e2147d4a7bf051aaa8866468ffbeb5d6e8b0f77f9"
      },
      {
        "id": "",
        "name": "10610e15b66028f62a1c30f9bcb71f30171c3a9f04df6d73f76cb81b4401abbe"
      },
      {
        "id": "",
        "name": "08ea9f2f0b1270a2bd2639b6d1054113c74dc111b923d9f35324cde49d7e4758"
      },
      {
        "id": "",
        "name": "06019995309fec0a69f50b0bfeb9b74cd8be91f0212f3b3ad24b211ba18da139"
      },
      {
        "id": "",
        "name": "03672dae225aa70a8983aa7d34785f66a35082f364dd1cb3815cd67049437ad7"
      },
      {
        "id": "",
        "name": "ba2e21641a1238a5b30e535bd0940fcd316a6e5242bfdd48a97aaa203d11642b"
      },
      {
        "id": "",
        "name": "85a6ac13510983b3a29ccb2527679d91c86c1f91fdfee68913bc5d3d01eeda2b"
      },
      {
        "id": "",
        "name": "74ba5883d989566a94e7c6c217b17102f054ffbe98bc9c878a7f700f9809e910"
      },
      {
        "id": "",
        "name": "b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca"
      }
    ],
    "malware": [
      {
        "id": "e0ffd7fb-6a25-4365-a0f4-998a03b2e6ef",
        "name": "OLMAPI32.dll",
        "slug": "olmapi32dll"
      },
      {
        "id": "203ed1a3-d8ab-4c0b-b4e4-02a513d39079",
        "name": "Figlio.exe",
        "slug": "figlioexe"
      },
      {
        "id": "bf2b1c10-eb7d-4ed2-ae8f-b4a28be564aa",
        "name": "stom.jpg",
        "slug": "stomjpg"
      },
      {
        "id": "dec1c4bf-821e-44a6-a393-6072dd9884f8",
        "name": "sstn.exe",
        "slug": "sstnexe"
      },
      {
        "id": "fc0062ad-8c7d-49ae-94b7-82d59112fa62",
        "name": "scm.exe",
        "slug": "scmexe"
      },
      {
        "id": "2ec92fb3-5594-48bc-8e66-102ee3882197",
        "name": "schs.exe",
        "slug": "schsexe"
      },
      {
        "id": "8d24d265-5eec-4d70-b19f-baf04d6b9ff4",
        "name": "sparrow.jpg",
        "slug": "sparrowjpg"
      },
      {
        "id": "2c223bcf-9f0c-4e26-bdbe-365b5461ce14",
        "name": "SearchApp.jpg",
        "slug": "searchappjpg"
      },
      {
        "id": "83e8dbe8-169a-4132-99c0-f182f26f4140",
        "name": "ORPCBackdoor",
        "slug": "orpcbackdoor"
      }
    ],
    "intrusion_sets": [
      {
        "id": "f11224bc-fba4-4c43-b61d-722c539ca817",
        "name": "Bitter APT Group",
        "slug": "bitter-apt-group"
      }
    ],
    "attack_patterns": [
      {
        "id": "7616ff60-a18f-4663-9824-b889aa01c8ce",
        "name": "T1588"
      },
      {
        "id": "d5c953ff-b143-41b6-bf2d-87b829132ea5",
        "name": "T1135"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://strikeready.com/blog/open-sesame",
    "https://otx.alienvault.com/pulse/66c34a2fea24f9f64610c55a"
  ]
}