Threat intelligence

Suspected origin

[South Asia]

First seen

2013-01-01 00:00:00

Motivation

Information theft and espionage

Targeted sectors

Energy, Engineering, Government

TLP

WHITE

(Forcepoint) Forcepoint Security Labs recently encountered a strain of attacks that appear to target Pakistani nationals. We named the attack “BITTER” based on the network communication header used by the latest variant of remote access tool (RAT) used. Our investigation indicates that the campaign has existed since at least November 2013 but has remained active until today.

Also known as

BITTERG1002T-APT-17TA397

Vulnerabilities exploited

CVE-2021-1732CVE-2018-0802CVE-2018-0798CVE-2017-12824CVE-2017-11882CVE-2012-0158

Tooling and malware

ZxxZ

MITRE ATT&CK techniques

T1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1568 Dynamic ResolutionT1573 Encrypted ChannelT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege Escalation

Coverage 2

threat-intel

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Chinese and Indian-aligned threat actors have been conducting sustained cyber espionage campaigns targeting Pakistani law enforcement organizations, including the Balochistan Police, Khyber Pakhtunkhwa Police, Islamabad…

The Hacker News · Jul 11, 2026 High

CHINPAcyber espionagelaw enforcementchina

threat-intel

China, India ran separate spying campaigns against same Pakistani police force

Separate hacking campaigns, linked to China and India, targeted the same Pakistani police force – specifically the Balochistan Police – over a two-year period. These campaigns aimed to access sensitive data including cri…

The Record · Jul 10, 2026 High

CHINPAcyber espionagedata breachgeopolitics

All articles