Skip to content
Bitter APT Targets Pakistan Telecommunication Amid Regional Conflict

Bitter APT Targets Pakistan Telecommunication Amid Regional Conflict

First seen 11 Nov 2026, 17:03 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 17:09 UTC
  • •Bitter APT targeted PTCL during military tensions between Pakistan and India.
  • •The attack utilized spear phishing with a malicious IQY attachment delivering WmRAT malware.
  • •Stolen credentials from Pakistan's Counter Terrorism Department were likely used in the attack.

On May 7, 2025, during heightened military tensions between Pakistan and India, Bitter APT (TA397) targeted the Pakistan Telecommunication Company Limited (PTCL) in a spear phishing campaign. The attack aimed to deliver malware, likely using stolen email credentials from Pakistan's Counter Terrorism Department. PTCL employees in critical roles, including 5G engineers and project managers, were specifically targeted. The malicious email contained an Internet Query (IQY) attachment that executed a variant of WmRAT upon opening. This incident highlights the ongoing cyber espionage operations linked to state actors in South Asia, particularly during periods of military escalation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2d ago How this analysis works

Timeline

2025-05-07
Bitter APT spear phishing attack on PTCL
Bitter APT executed a spear phishing campaign against PTCL, targeting critical personnel with malware-laden emails.
EclecticIQ

More articles in this cluster (2)

Following this threat?

Track APT-C-08, ArtraDownloader and Islamabad Police Headquarters in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (41)

1 / 3

Common questions

What methods were used in the attack?
The attack involved spear phishing emails with malicious IQY attachments that executed WmRAT malware.
Who was targeted in this attack?
The attack specifically targeted PTCL personnel in critical roles, including engineers and project managers.
What is the current status of the attack?
The attack has been confirmed, and it is part of ongoing cyber espionage activities linked to state actors.