Bitter APT adds Bangladesh to their targets
Summary: Cisco Talos reported an ongoing campaign it attributes with moderate confidence to the Bitter APT group, active since August 2021, targeting high-ranking officers of Bangladesh's Rapid Action Battalion through spear-phishing emails carrying malicious RTF documents or Excel spreadsheets. The attachments launch Microsoft Equation Editor to exploit CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802, then download a trojan named ZxxZ that masquerades as a Windows security update service and communicates with the C2 server helpdesk[.]autodefragapp[.]com.
What's compelling: Bitter has been active since 2013 and is mainly motivated by espionage, and this campaign extends its targeting to Bangladeshi government entities using Office vulnerabilities patched years ago - a reminder that unpatched Equation Editor flaws remain a working entry point for state-aligned actors.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-11882CVE-2018-0798CVE-2018-0802CVE-2021-28310
- Related
- Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway) Cyber Risks ·CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021