Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In March 2023, cybersecurity firm Intezer reported a phishing campaign targeting people in China’s nuclear-energy industry, as well as some academics connected to the field. The emails impersonated the Kyrgyzstan Embassy in China and used conference invitations to deliver malicious files. Intezer attributed the activity to Bitter APT based on similarities in tactics and techniques; the reporting does not establish an official government attribution or show that nuclear facilities or operational systems were compromised.
What happened in the reported campaign?
Intezer’s March 24, 2023 analysis identified seven phishing emails themed around the Kyrgyzstan Embassy in China. The messages invited recipients to conferences on nuclear-related topics and used diplomatic and technical details to appear credible. Recipients were encouraged to open a RAR archive containing either a Microsoft Compiled HTML Help (CHM) file or an Excel file. Intezer’s technical analysis described the delivery chain; SecurityWeek’s March 28, 2023 coverage summarized the findings.
How did the phishing attachments work?
The observed files attempted to establish scheduled tasks and retrieve or run later malware. The precise behavior differed by attachment and variant.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Excel files
The Excel documents used an Equation Editor exploit. One observed file attempted to create a scheduled task to download a subsequent executable; another attempted to run that executable. Intezer also noted that updated first-stage payloads included additional obfuscation and decoys.
#1 Best Overall
CHM files
The CHM files also created scheduled tasks and fetched later payloads. One variant used msiexec to run a remote MSI installer, while another used an encoded PowerShell command. These actions describe attempted malware delivery, not evidence that every recipient’s computer was successfully infected.
What is known about the impact?
Intezer said it did not retrieve further payloads from the command-and-control servers. In some cases, researchers received empty MSI files and could infer filenames of possible later stages. The report therefore does not confirm what additional malware, if any, was successfully delivered in this campaign.
Rank #2
Intezer mentioned possible keyloggers, remote-access tools, file stealers, and browser-credential stealers by reference to payloads associated with earlier Bitter activity. Those capabilities were not confirmed as delivered in this operation. The reviewed reporting does not establish a victim count, confirmed data theft, compromise of a nuclear facility, or disruption of operations. It concerns email recipients and malware delivery attempts; it does not report compromise of reactors, operational technology, or safety systems.
Free tools Windows power users keep installed
One-click scans. No signup required.
Who did researchers say was behind it?
Intezer attributed the activity to Bitter APT because the campaign’s tactics, techniques, and procedures resembled activity previously attributed to that group. Intezer described Bitter as a South Asian threat group that commonly targets energy and government organizations. This is a researcher attribution based on behavioral similarities, not an official government attribution.
Rank #3
A 2025 CISA advisory on other PRC-linked operations provides broader context on state-sponsored activity and cautions that commercial threat-group names may not map one-to-one to government groupings. It does not establish a connection between those operations and the 2023 Bitter-attributed campaign.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should organizations take away?
The lure relied on a plausible diplomatic identity and a subject relevant to recipients’ work. Intezer security researcher Ryan Robinson advised: “Always verify that the sender is trusted and understand that even if it claims to be from a particular person, it might not be.”
- Verify unexpected diplomatic or conference invitations through a trusted contact method rather than relying on the sender name, signature, or subject matter.
- Treat unexpected archives and CHM files as suspicious; Intezer specifically cautioned against opening CHM attachments.
- Make it easy for staff to report suspicious email so security teams can investigate it.
These steps address the observed lure and delivery methods, but the report does not test or guarantee the effectiveness of any particular control.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
