BitterAPT: Evolution of an Android Espionage Tool – from open-source to custom RAT

mood · Jun 18, 2020

BitterAPT Revisited: the Untold Evolution of an Android Espionage Tool
June 18, 2020
https://labs.bitdefender.com/2020/0...ntold-evolution-of-an-android-espionage-tool/

In 2016, a sophisticated malware campaign targeting Pakistani nationals made headlines. Dubbed Bitter, the Advanced Persistent Threat group (also known as APT-C-08) has been active both in desktop and mobile malware campaigns for quite a long time, as their activity seems to date back to 2014.

The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions for Android (released in 2014) were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.

This paper is a technical account of the developments related to Bitter, its evolution and how, steadily and surely, threat actors are raising their game and poking holes in Google Play to use the platform as a distribution channel.
Click to expand...

Whitepaper: https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf

Over the years, cross platform Android – Windows Bitter attribution has relied on the same domains being used by the malware in both scenarios, as well as by victimology [1][4]. The Bitter threat group has been using ArtraDownloader for its Windows campaign [10] and AndroRAT variations for its Android campaigns.

Worth mentioning is that the group has delivered malware for both Windows and Android via the same hacked sites.
The Bitter threat group is believed to operate out of a country in South Asia [6][12]. [...]
Click to expand...

Log in or Sign up

BitterAPT: Evolution of an Android Espionage Tool – from open-source to custom RAT

mood Updates Team