BITTER: A Targeted Attack Against Pakistan

Forcepoint Security Labs documents the "BITTER" campaign — a targeted, ongoing espionage-style campaign against Pakistani targets that uses spear-phishing (CVE-2012-0158) to deliver Windows RATs and Android AndroRAT variants. The report describes RAT capabilities (remote shell, file enumeration/exfiltration), C2 mechanisms (HTTP and encrypted TCP, DDNS and hosted domains), compilation/PDB timelines, associated domains and hashes, and recommended protections to block lure, droppers, and C2 communications.