HAZY_TIGER__2019__Bitter_APT_Malware_analysis.pdf

Malware analysis of the Bitter APT campaign describing a remote template RTF exploitation chain that delivers an ArtraDownloader/backdoor; the report details string-decoding routines, persistence via registry Run keys, system and GUID discovery, C2 beaconing (domains/IPs in Bulgaria/Ras al-Khaimah infrastructure), MITRE ATT&CK technique mappings, and a set of IOCs for detection and response.