Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
In November 2024, two C++-malware families identified as WmRAT and MiyaRAT were delivered to a Turkish defense sector business by Bitter, a suspected South Asian cyber espionage threat outfit.
In a report shared with The Hacker News, Proofpoint researchers Nick Attfield, Konstantin Klinger, Pim Trouerbach, and David Galazin claimed that the attack chain used different data streams in a RAR archive to deliver a shortcut (LNK) file that generated a scheduled task on the target machine to pull down additional payloads.
The threat actor, known as TA397, is being tracked by the enterprise security firm. The adversary is also known as APT-C-08, APT-Q-37, Hazy Tiger, and Orange Yali, and has been known to be active since at least 2013.
The hacking group's previous efforts have targeted ...