Multiple Artra Downloader Variants Used by BITTER to Target Pakistan
Summary: Unit 42 reports that the suspected South Asian threat group BITTER has used a previously unreported downloader family, ArtraDownloader, to target Pakistan and Chinese organizations since at least 2015, with the earliest sample compiled in February 2015. Between September 2018 and January 2019, BITTER used three ArtraDownloader variants to target Pakistan and Saudi Arabia, delivering the BitterRAT remote access trojan through malicious documents hosted on compromised legitimate Pakistan websites, including government sites.
What you should know: Roughly 80 unique ArtraDownloader samples have been found, and the malware relies on simple registry persistence and HTTP requests rather than sophisticated techniques, yet it compromised Pakistan government sites and an engineering firm to deliver BitterRAT. The same BITTER infrastructure overlapped with the earlier MY24 payload, showing a threat actor that reuses tooling across years while remaining active against Pakistan, China, and Saudi Arabia.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2017-11882
- Related
- My Little Form Book Cyber Risks ·Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox Cyber Risks ·SWEED: Exposing years of Agent Tesla campaigns Cyber Risks ·