The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released in 2014 were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.
Also known as
Bitter, T-APT-17, APT-C-08, Orange Yali, TA397.
References
Actor metadata imported from Malpedia (Fraunhofer FKIE).