Open Sesame

The Bitter APT Group has a storied history of targeted cyber espionage, primarily focusing on South Asia. Their operations have been characterized by persistent attempts to infiltrate governmental and industrial entities to gather sensitive information. The group has shown an ability to bypass security technologies by leveraging obscure file formats, as well as leveraging password-protected or otherwise encrypted payloads.

It can be difficult to track all the tools an actor uses, and disambiguate ownership between associated teams, especially without hundreds of incident responders on the bench.

That being said, sometimes the attacker makes it easy, and they leave a copy of their backdoors on a misconfigured server, which was the case of libraofficeonline.com. In addition to the payloads being available, the zip was also available, named op.zip, probably short for operation.zip. A zip file is especially useful when dealing with backdoors that may be interpreted by a handler, such as .php files. The analysis of some of these interesting files is given below.

Figure 1: Apache “open directory”

File Analysis and Identified Threats:

1. op.zipThe zip file named op.zip (SHA256: b8beb5e27fc339772b63ed454ec054a16b554e5c354eab8de7b4addbe238f403) was found on a command and control server, and was likely mistakenly exposed by the actor. It contains multiple files with functionalities ranging from basic backdoors to information stealers. Among these files, one exciting file is the msws.msi, which further drops the payload of ORPCBackdoor.
2. msws.msiThis file is dropping a cab file which contains a payload of ORCPBackdoor (SHA256: 74ba5883d989566a94e7c6c217b17102f054ffbe98bc9c878a7f700f9809e910)
3. It acts as a delivery mechanism, dropping multiple files and contributing to espionage activities.
4. SearchApp.jpgConstructs a URL using the username and computer name, contacting https://oraclewebonline[.]com/log.php.
5. Downloads command into C:\Users\[user]\AppData\Roaming\commands.txt, executes them, and uploads the results back to the server.
6. Sparrow.jpgAttempts to connect to IP address 176.124.33.42 on port 443.
7. Sends an encoded "hello" message, receives commands, decodes them, and executes various operations such as listing directories, running shells, deleting files, and more.
8. schs.exeA browser credential stealer.
9. Extracts information from Firefox and Thunderbird stores it in C:\Users\Public\Documents\ats and creates a zip file of this folder.
10. scm.exeAnother browser credential stealer.
11. Targets Chrome, Edge, and Brave browsers, saves the data in C:\Users\Public\Documents\als and zips the folder.
12. sstn.exesstn.exe is a screenshot-capturing application. It creates a mutex to ensure that only one instance of the application runs at a time.
13. The application captures screenshots, saves them locally, resizes the images, and sends them to a remote server located at windowphotoviewer[.]com on port 443.
14. stom.jpgTraverses user directories and uploads files.
15. Targets specific file extensions, uploads them to http://172.86.68.175[:]4443/upload and avoids re-uploading by checking file hashes.
16. Figlio.exeAnother backdoor file
17. Connects to the IP address 91.132.93.235 on port 443, sends machine name and username, and executes received commands.
18. OLMAPI32.dllThe ORPC Backdoor does information collection of processes currently running on the host, gets detailed system information, and executes server commands.
19. The backdoor uses outlook-web.ddns[.]net as C2.

Indicators of Compromise (IOCs)

Identifying and understanding IOCs is critical in detecting and mitigating threats from the Bitter APT Group. Below are some of the key IOCs associated with their latest campaigns:

Fortuitously, while analyzing this sample set, we also came across another open directory, this time on kimfilippovision.com.

Figure 8: Open directory exposing more payloads

These rar files mainly contain their standard top level CHM droppers, and are detailed in the below appendix, although it’s worth calling out a less used PPS dropper Policy changes review.pps with the following code, shown deobfuscated for clarity.

Figure 9: rarely used PPS delivery

Noteworthy, the logs point to the next stages the attackers are installing on their victims,as noted on X. The attacker leverages custom command files for each victim it wants to install their payloads on.

Figure 10: Manual commands executed on hosts the actors were interested in

Figure 11: Dropped files on interesting victims

In this blog, we’ve also incorporated insights from CARA, our AI-based virtual assistant. CARA leverages advanced machine learning algorithms to analyze cybersecurity threats and provide real-time insights and recommendations. CARA can interactively query information about specific threats, helping users to understand and mitigate risks more effectively. In addition, customers can also search through our TLP:WHITE data store to help them analyze payloads futher.

Figure 12: CARA showing available Bitter's simulations to test your tooling

Figure 13: CARA showing information about specific payloads

Figure 14: Customers can now search through our databases and download payloads

Figure 15: Files mentioned in this blog

Figure 16: Network indicators

The following YARA rules are for illustration, and should be used as a reference for interested signature authors.

Figure 17: Sample YARA rules

Conclusion

The Bitter APT Group iterates rapidly, and by understanding their tactics and incorporating the identified IOCs, you can better defend against these persistent threats. As with all investigations, collaboration with the cybersecurity community is key, and we hope you’ll follow along with us on X athttps://x.com/StrikeReadyLabs

Our github provides a download to theraw samples mentioned in the blog, as well as the indicators.

Acknowledgements

Special thanks to SH, KS, and IN for their contributions, as well ashttps://x.com/Thisism23567356who noted an additional open directory we missed. Please get in touch atresearch@strikeready.comif you have corrections, or would like to collaborate on research.

The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Please get in touch at research@strikeready.comresearch at strikeready dot com if you have corrections, or would like to collaborate on research.