The Bitter end: unravelling 8 years of APT antics

The Bitter end: unravelling 8 years of APT antics

Speakers: Abdallah Elshinbary (Threatray), Nick Attfield (Proofpoint), Konstantin Klinger (Proofpoint), Jonas Wagner (Threatray)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=FBBAWgW1qFE

Overview

This talk, a collaborative research effort between Proofpoint and Threatray, delves into the persistent and evolving tactics of TA397, also known as Bitter. For years, public research has broadly attributed Bitter's activities to a generic "South Asian threat actor." The researchers behind this presentation aimed to challenge this ambiguity, taking the attribution "all the way" by meticulously analyzing eight years of the group's operations. The presentation offers a compelling narrative of how Proofpoint's extensive telemetry, combined with Threatray's deep malware analysis, unraveled the actor's infection chains, hands-on keyboard activities, and sophisticated payload arsenal, ultimately leading to a precise and actionable attribution.

The significance of this research lies in its detailed technical exposition and its successful pinpointing of a specific nation-state actor. By examining everything from email lures and initial access methods to complex scheduled tasks, C2 communications, and a vast collection of custom malware, the team provides an exhaustive profile of TA397. This granular insight not only enhances the cybersecurity community's understanding of this persistent threat but also offers crucial defensive implications, demonstrating how focused, collaborative research can significantly impact an advanced persistent threat's operational tempo.

The speakers, Nick Attfield and Konstantin Klinger from Proofpoint, and Abdallah Elshinbary and Jonas Wagner from Threatray, guide the audience through the intricate journey of their investigation. They highlight the consistent elements of TA397's campaigns, such as their preference for specific scheduled task patterns, alongside their continuous experimentation with initial infection vectors. The talk culminates in a strong assessment of TA397's likely affiliation with an Indian intelligence organization, supported by compelling evidence derived from timestamp analysis and victimology.

Background

▶ Watch: Introduction: Unravelling 8 years of APT antics (0:00)

The motivation for this extensive research stemmed from the prevailing ambiguity surrounding TA397's attribution. While the actor was widely recognized as originating from South Asia, a more precise identification was lacking. Proofpoint and Threatray sought to fill this gap by applying a rigorous attribution methodology, combining common industry practices with elements specific to email-based campaigns. This included scrutinizing the content and volume of malicious messages, delivery techniques, and the specific targets chosen by the actor.

TA397's profile, as characterized by Proofpoint, reveals a sophisticated adversary. Their capabilities consistently involve the delivery of payloads designed to establish a specific structure of scheduled tasks, with a strong preference for CHM files (Compiled HTML files) as a primary means of initial delivery. Their arsenal predominantly features C++ or .NET RATs (Remote Access Trojans). From an infrastructure perspective, TA397 demonstrates considerable sophistication, making tracking challenging based on infrastructure alone. However, their reliance on compromised government email addresses, free mail accounts, and initial first-stage infrastructure almost exclusively hosted with Let's Encrypt certificates (typically valid for 90 days and often wildcard certificates) provides detectable patterns. The vast majority of their targeting is directed at government and diplomatic organizations, with additional focus on defense and energy sectors.

Despite their sophistication, a critical observation underpinning this research was TA397's consistent adherence to a specific scheduled task pattern. While the actor frequently experiments with novel infection chains—using various file types like MSCs, LNKs, MS Access files, IQs, and search connector MS files, often nested within RAR or ZIP archives, or delivered via actor-owned URLs—the core scheduled task mechanism remains largely unchanged. This dichotomy of constant innovation in initial access coupled with unwavering persistence in post-compromise activity presented a unique opportunity for detection and attribution, forming a central pillar of the research.

Key Findings

▶ Watch: Actor mounts network share; accesses exfiltrated documents (8:20)

The comprehensive analysis by Proofpoint and Threatray yielded several pivotal findings that significantly refine the understanding and attribution of TA397. Foremost among these is the strong assessment that TA397, or Bitter, is an espionage-focused threat actor highly likely operating on behalf of an Indian intelligence organization. This conclusion is supported by multiple lines of evidence, including victimology, operational hours, and specific TTPs.

Victimology patterns consistently show TA397 primarily targeting government and defense organizations across Asia and Europe. A particular focus is observed on entities with existing relations or interests in China, Pakistan, and other neighboring countries on the Indian subcontinent. Crucially, the researchers noted a complete absence of activity targeting India itself, a strong indicator of nation-state alignment.

A breakthrough in attribution came from timestamp analysis. By plotting observed timestamps from hands-on keyboard activity, C2 infrastructure, passive DNS records, Let's Encrypt certificate creation, and WHOIS domain registration dates, and then adjusting these to the Indian Standard Time (IST) zone, a clear pattern emerged. The vast majority of focused activity, particularly hands-on keyboard operations, falls squarely into a standard 9-to-5 working day in India. While some outliers existed in passive data (due to propagation delays), the consistency in direct operational activity provided compelling evidence.

Technically, the research highlighted TA397's unwavering reliance on a specific scheduled task pattern for persistence. Despite extensive experimentation with initial infection vectors, this scheduled task—designed to beacon to a C2 every 16 minutes—remained constant for years, becoming a key detection signature. Furthermore, the team uncovered instances of the actor mounting bidirectional network shares on compromised machines. This technique, used to copy and execute next-stage payloads, inadvertently provided researchers with access to the actor's own share, which contained what are presumed to be exfiltrated documents from other victims, offering invaluable insights into their operations and victimology.

Finally, the study meticulously documented TA397's extensive and evolving payload arsenal, comprising approximately 11 distinct malware families. These tools, largely homegrown and often simplistic in design, exhibit consistent shared TTPs in areas like information gathering, string obfuscation, and subtle code variations across different variants. This commonality strongly ties the diverse toolset to a single, persistent actor. The research also demonstrated a tangible impact: public disclosure of their findings led to a significant, albeit temporary, drop-off in TA397's campaign volume, underscoring the value of transparent threat intelligence.

Technical Deep Dive

▶ Watch: Overview of Bitter's evolving payload arsenal (12:00)

TA397's operational methodology is characterized by a blend of consistent, hard-to-change core components and highly adaptable initial infection chains. Proofpoint's telemetry reveals the actor's preference for delivering payloads that establish a specific scheduled task structure, often leveraging Compiled HTML Help (CHM) files or more esoteric formats. Their malware arsenal leans heavily towards custom-developed C++ or .NET RATs. The C2 infrastructure is designed with a degree of sophistication, frequently utilizing Let's Encrypt certificates that are valid for 90 days and often employ wildcards for the domain, adding a layer of complexity to infrastructure-based tracking.

The email lures employed by TA397 are diverse but effective. They often incorporate topical themes aligning with current events, such as references to martial law imposition or geopolitical developments. Common tactics include the creation of fake documents attached as decoys to lend legitimacy and urgency, or simpler emails spoofing government or diplomatic organizations with a single malicious attachment or URL.

The infection chains show TA397's continuous experimentation to bypass detections and exploit new vulnerabilities. While CHM files are favored, the actor has been observed using Microsoft Script Console (MSC) files, LNK shortcuts, MS Access files, Internet Query (IQ) files, and search connector MS files. These are frequently delivered within RAR or ZIP archives to complicate static analysis and detection. Alternatively, actor-owned infrastructure URLs are used to drop these initial malicious files. Crucially, regardless of the initial infection vector, the ultimate goal remains the creation of a highly consistent scheduled task.

This scheduled task is the bedrock of TA397's persistence. An exemplary pattern involves using PowerShell via conhost to beacon to a C2 server every 16 minutes. The C2 communication leverages a specific PHP URI pattern and exfiltrates the infected machine's computer name and username. User agents observed include "Windows PowerShell" and "curl." While the delimiter between the computer name and username in the exfiltrated data might vary, the overall structure of the beacon and exfiltration remains constant. This consistency makes host-based detection highly effective: by monitoring for this specific scheduled task, PHP URI pattern, and exfiltration format, organizations can reliably identify TA397 activity. Complementary network detections can also be built around the C2 domain's use of 90-day Let's Encrypt wildcard certificates.

To further understand the actor's post-exploitation activities, researchers employed a unique strategy: manually running the malicious files in a bare-metal sandbox environment. This allowed them to wait for the actor's interactive engagement, which typically began during India's daytime working hours. This process enabled the retrieval of next-stage payloads and commands. A critical discovery from this hands-on interaction was the actor's use of bidirectional network shares. TA397 would mount a network share to copy and execute further payloads on the infected machine. This bidirectional access meant that researchers could also access the share, revealing numerous documents presumed to be exfiltrated from other victims, providing unparalleled insight into the actor's operations.

The timestamp analysis provided the strongest evidence for attribution. By collecting timestamps from various sources—hands-on keyboard activity, C2 infrastructure registration, passive DNS observations, Let's Encrypt certificate creation, and WHOIS domain registrations—and then mapping them against a 24-hour cycle adjusted to Indian Standard Time (IST), a distinct pattern emerged. The majority of activity, especially direct hands-on keyboard actions, clustered within the 9-to-5 IST working day. While passive data showed more dispersion due to internet propagation delays, the direct operational timestamps strongly supported an India-based origin.

TA397's payload arsenal is extensive, encompassing around 11 malware families, showcasing an evolution over three distinct phases. Early years (2016-2020) saw simplistic download-and-execute tools like Artra downloader. The mid-period brought more advanced capabilities, including Muid downloader (a successor to Artra, still active), Betrat (their first .NET RAT), Almondrat (a second .NET RAT), Wmrat, and RPC backdoor. More recently (2024-2025), the actor deployed Miarat (their most complete RAT to date) and purpose-built simple loaders like Google Blitz (a shellcode loader) and Kiwi. This arsenal highlights a clear preference for homegrown, simplistic tooling, with the primary complexity residing in the initial infection chain rather than the payloads themselves.

Despite the diversity, several shared TTPs tie these families together. A highly prevalent pattern is their information gathering methodology: malware consistently collects computer name, OS information, and username, submitting this data to the C2 in a very similar structure across different families. Obfuscation techniques also show consistency, evolving from simple character addition/subtraction for strings and configurations to XOR encryption with custom keys in C/C++ and .NET code. Later .NET RATs also incorporated AES encryption for configurations. Finally, slight code variations between variants of the same malware family (e.g., how Muid downloader formats its payload or how Miarat implements string decryption) serve as unique fingerprints for tracking TA397's development.

A deep dive into four specific tools further illustrates TA397's development:

• Bdark RAT: Active from 2019-2025, also known as Splinter RAT or Turtle Power. It's based on the open-source Dark Agent RAT (published in Hack Forums 2010, GitHub 2011). TA397 continuously developed it, shifting from descriptive to numerical C2 commands, adding screen capture and PowerShell execution, and oscillating between hex-encoded and AES-256 encrypted C2 addresses.
• MUI Downloader: Seen 2021-2025, a successor to Artra, known as ZXXZ downloader. It drops other TA397 tools and uses simple character addition/subtraction or XOR for string encoding. Its unique payload retrieval method involves downloading a payload missing the first PE header byte (0x4D), then appending this byte before writing and executing the file, likely to evade network detections.
• Miarat: Active since 2024, collecting system information and a hardcoded version number. It concatenates data with a pipe character before sending it to the C2. C2 addresses are decoded via simple character subtraction, with recent variants employing XOR encryption with a single-byte key. Version 5, observed by Proofpoint, featured obfuscated C2 command strings, potentially bypassing string-based detection rules.
• RPC Backdoor: A simple backdoor seen in 2022, implementing basic C2 functionality like screen sharing and screenshots. It communicates using the RPC protocol and encodes C2 commands/strings with simple hex encoding. Notably, this backdoor has been reported to be used by another regional threat actor, Mysterious Elephant / ABTK47, in 2023, suggesting potential tool sharing or false flag operations.

Demo / Proof of Concept

▶ Watch: Identifying shared TTPs across malware families (14:40)

While the talk did not feature a live, interactive demonstration in the traditional sense, the researchers detailed their methodology for actively engaging with TA397's post-exploitation activities, which served as a robust proof of concept for their analytical capabilities and the actor's TTPs. This involved deploying the initial malicious files in a carefully controlled bare-metal sandbox environment. By mimicking an authentic victim profile, the team would run the initial dropper that established the scheduled task and then patiently wait.

The success of this approach was evident as, during India's daytime working hours, TA397 operators would interact with the compromised machine. This allowed the researchers to observe and capture the next-stage payloads and commands issued by the C2. A critical "proof of concept" of the actor's operational method was the observation of TA397 mounting a bidirectional network share. This action, intended by the actor to copy and execute further payloads onto the infected machine, inadvertently exposed their own share to the researchers. This access allowed the Proofpoint/Threatray team to analyze what appeared to be exfiltrated documents from other victims, directly validating the actor's data theft objectives and providing invaluable intelligence. This hands-on, observational approach effectively demonstrated TA397's operational cycle from initial compromise to data exfiltration.

Defensive Implications

▶ Watch: Impact of research: Campaign drop-off and resurgence (23:45)

The detailed insights into TA397's operations offer several critical defensive implications for organizations, particularly those in government, diplomatic, defense, and energy sectors with interests in China, Pakistan, or neighboring Indian subcontinent countries.

1. Prioritize Host-Based Detection for Scheduled Tasks: The most consistent and reliable indicator of TA397 activity is their unchanging scheduled task pattern. Defenders should implement robust endpoint detection and response (EDR) rules to identify:

• Scheduled tasks beaconing every 16 minutes.
• Tasks executing PowerShell via conhost.
• C2 communication using specific PHP URI patterns.
• Exfiltration of computer name and username (even with varying delimiters).
• Usage of specific user agents like "Windows PowerShell" or "curl" in C2 communications.

This host-centric approach will be more resilient than relying solely on initial infection chain indicators, which the actor frequently changes.

1. Monitor for Network Share Activity: The discovery of TA397 mounting bidirectional network shares for payload delivery and exfiltration is a significant finding. Organizations should monitor network traffic for suspicious outbound connections establishing network shares (e.g., SMB over WAN) from internal hosts, especially those that have been potentially compromised. This could indicate active hands-on-keyboard activity by the threat actor or data staging.

1. Enhance Email and Initial Access Defenses: While TA397 frequently experiments, organizations must maintain strong defenses against their preferred initial access vectors:

• Implement advanced email filtering to detect spoofed government/diplomatic emails, topical lures, and fake document attachments.
• Be vigilant against unusual file types like CHM, MSC, LNK, MS Access, IQs, and search connector MS files, particularly when delivered within RAR or ZIP archives.
• Ensure robust URL filtering and sandboxing for actor-owned infrastructure links.

1. Adapt to Payload Evasion Techniques: Defenders need to be aware of TA397's methods for evading detection, such as:

• MUI Downloader's technique of downloading payloads with a missing PE header byte (0x4D). Network security solutions should be capable of reassembling and analyzing such fragmented binaries.
• Miarat's use of obfuscated C2 command strings (as seen in version 5). Generic string-based rules might fail, necessitating more sophisticated behavioral analysis or dynamic unpacking.
• The use of XOR or AES encryption for C2 communications and configurations requires decryption capabilities for effective analysis.

1. Leverage C2 Infrastructure Indicators: While TA397's infrastructure is sophisticated, the consistent use of Let's Encrypt certificates (90-day validity, often wildcard) can be a contributing factor for detection when combined with other indicators. Threat intelligence feeds should be enriched with patterns related to TA397's C2 infrastructure.

1. Contextualize Threat Intelligence with Attribution: The attribution to an Indian intelligence-backed actor operating during IST business hours provides crucial context. Security operations centers (SOCs) can use this information to prioritize alerts and focus investigations during these specific timeframes, especially for targets aligned with TA397's victimology.

1. Anticipate Tool Sharing/Overlap: The observation of the RPC Backdoor being used by both TA397 and Mysterious Elephant / ABTK47 highlights the potential for tool sharing or overlap between regional actors. Defenders should not rely on a single tool as a definitive attribution marker but rather combine it with a broader understanding of TTPs.

By focusing on these defensive implications, organizations can significantly improve their ability to detect, prevent, and respond to TA397's persistent and evolving threat.

Key Takeaways

• Precise Attribution: TA397, or Bitter, is assessed as an espionage-focused threat actor highly likely operating on behalf of an Indian intelligence organization, targeting government and diplomatic entities with ties to China, Pakistan, and other neighboring countries.
• Consistent Persistence Mechanism: Despite continuous experimentation with initial infection chains (e.g., CHM, MSC, LNK files), TA397 consistently relies on a specific, unchanging scheduled task pattern for persistence, beaconing to its C2 every 16 minutes.
• Operational Hours Alignment: The actor's hands-on keyboard activity and infrastructure-related actions strongly align with a 9-to-5 working day in the Indian Standard Time (IST) zone, a key attribution indicator.
• Diverse, Homegrown Malware Arsenal: TA397 utilizes a comprehensive and evolving arsenal of approximately 11 homegrown malware families, including RATs like Bdark RAT and Miarat, and loaders like MUI Downloader, all exhibiting identifiable shared TTPs.
• Unique Network Share Exploitation: The actor employs bidirectional network shares for post-exploitation activities, a technique that inadvertently allowed researchers to access exfiltrated victim documents, providing rare insight into their operations.
• Adaptable Evasion, Detectable Core: While TA397 adapts initial access and payload evasion techniques (e.g., missing PE header bytes, obfuscated C2 strings), their core scheduled task and shared TTPs remain consistent, offering reliable detection opportunities for defenders.

About the Speaker(s)

The talk "The Bitter end: unravelling 8 years of APT antics" was presented by a collaborative team of threat intelligence and malware analysis experts. Abdallah Elshinbary and Jonas Wagner are affiliated with Threatray, a company specializing in advanced malware analysis. Nick Attfield and Konstantin Klinger are researchers from Proofpoint, a leading cybersecurity and compliance company known for its extensive email telemetry and threat intelligence. Together, their combined expertise in tracking sophisticated threat actors, analyzing malware, and correlating vast datasets was instrumental in unraveling the intricate operations of the TA397 threat group.