'Bitter' cyberspies target defense orgs with new MiyaRAT malware

Proofpoint observed the APT group Bitter targeting Turkish defense organizations with a new RAT family (MiyaRAT) used alongside WmRAT; the attackers delivered a RAR containing a decoy PDF, an LNK file, and alternate data streams that execute PowerShell, create a scheduled task to call a staging domain (jacknwoods.com), and fetch additional payloads, with IoCs and a YARA rule provided for detection.