kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · IN

HAZY TIGER

also tracked as bitter 1

1 story · 1 in the wild · November 4, 2026 – November 4, 2026

evidence: 1 observed

how they got in

  • removable media 1 · Nov 4

malware and tools

  • paprat 1 · Nov 4

techniques

  • delivery chain 1 · Nov 4

attack phases seen

  • Execution 1 · Nov 4
  • Initial access 1 · Nov 4

what we reported, newest first, grouped by story

November 4, 2026

  • Bitter added PapRAT and three distinct delivery chains: an LNK abusing ftp.exe's ! prefix to run local shell commands, a VHDX image carrying an LNK that shows a decoy spreadsheet while launching an MSI, and a RAR containing a .url shortcut that fetches an LNK over WebDAV (FortiGuard Labs). · Nov 4 · observed · via removable media · as bitter · Nation-State & Espionage