How to hunt geopolitically driven Bitter APT operations

The speaker is unable to attend VB2024; this presentation will be uploaded to our YouTube channel at a later date in 2024.

Shengbin Bao (Zhongfu Info)

Global geopolitical conflicts have intensified over the past year. Driven by geopolitics, more and more APT attacks are appearing. One of the hottest areas of geopolitical conflict is India and its surrounding countries. For many years, we have been tracking the activities of related APT groups in the region, such as Bitter, Sidewinder and VajraEleph. Among them, Bitter has been particularly active in the past year. We hunted some special activity and analysed it in detail.

In the past year, we discovered Bitter attacks against nuclear energy, diplomacy, university and business targets in Asian countries. We hunted Bitter’s complete attack chain, which included a total of three stages of malicious programs delivered by the attack and a stolen sensitive data log. At the same time, we discovered different techniques and tactics targeting the military, which targeted both Windows and Android platforms. What surprised us was that Bitter used the spyware LodaRAT, which gave it a subtle connection with the Kasablanka APT group.

We observed Bitter using Search Connector Description files (*.searchConnector-ms) files as the first-stage malicious program in February 2024, which makes it more difficult to hunt. We also hunted a sample of a weapon under development due to the actor's faulty testing behaviour.

In this talk, we will share some details about the Bitter espionage stories we investigated. We will focus on how to hunt the adversary's newest weapons, analysis of the adversary's TTPs, and adversary attribution.

Shengbin Bao Shengbin Bao is a senior security researcher at Zhongfu Info's YuanHeng Lab, based in China. After previously working as a researcher in Trend Micro’s malware research team and Qihoo 360's BAS (Breach & Attack Simulation) team, he is focused mainly on threat hunting and BAS, digging up its underlying stories and profiling the actors behind it. Today he is tasked with breaking down implants and campaigns in the realm of APTs and putting it all into intelligence reports for Zhongfu’s customers. Shengbin has previously presented some of his work at security conferences including Virus Bulletin, Kanxue, KCon and ISC. @BaoshengbinCumt

Back to VB2024 Programme page

Back to VB2024 conference page

Other VB2024 papers