HAZY_TIGER__2019__BITTER_APT_Not_So_Sweet.pdf

This report documents a BITTER APT campaign (active since ~2015) targeting Pakistani organizations by using malicious Word documents exploiting CVE-2017-11882 to download ArtraDownloader, which subsequently beacons to C2 infrastructure (e.g., onlinejohnline99.org, maq.com.pk) and likely distributes BitterRAT; the author analyzes sample behavior, network POSTs, VirusTotal pivots, hosting ISP patterns, and provides URLs and MD5 hashes as IOCs while discussing suspected regional attribution.