Threat Actor 🇮🇳 India

HAZY TIGER

Also known as: Bitter · T-APT-17 · APT-C-08 · Orange Yali · TA397

The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.

Indicators of Compromise 5

Domain cms[.]balochistanpolice[.]gov[.]pk Filename 360Safe.exe Filename cms_plugin.exe IP 142[.]171[.]183[.]8 IP 193[.]42[.]25[.]65

MITRE ATT&CK TTPs 1

T1059.001

PowerShell

Execution

Source Articles

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Cyber espionage campaigns targeting Pakistani law enforcement agencies, including the Balochistan Police, have been conducted by suspected China- and India-aligned threat actors between February 2024 and April 2026. The attackers exploited web applications such as the Complaint Management System to deploy custom malware, including PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. These operations targeted sensitive data including biometric records, criminal files, and personnel information, with infrastructure overlaps linking some activity to known threat groups like Mysterious Elephant. The compromise of public-facing portals extended the attack surface to both law enforcement and citizens.

hacker-news ·2w ago