Introduction
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018. Cymmetria Patchwork Symantec Patchwork TrendMicro Patchwork Dec 2017 Volexity Patchwork June 2018
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1059.005 Visual Basic
- T1560 Archive Collected Data
- T1083 File and Directory Discovery
- T1553.002 Code Signing
- T1574.001 DLL
- T1112 Modify Registry
- T1197 BITS Jobs
- T1027.005 Indicator Removal from Tools
- T1555.003 Credentials from Web Browsers
- T1053.005 Scheduled Task
- T1132.001 Standard Encoding
- T1055.012 Process Hollowing
- T1021.001 Remote Desktop Protocol
- T1547.001 Registry Run Keys / Startup Folder
- T1074.001 Local Data Staging
- T1036.005 Match Legitimate Resource Name or Location
- T1566.001 Spearphishing Attachment
- T1027.010 Command Obfuscation
- T1588.002 Tool
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1518.001 Security Software Discovery
- T1203 Exploitation for Client Execution
- T1027.002 Software Packing
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1204.002 Malicious File
- T1587.002 Code Signing Certificates
- T1070.004 File Deletion
- T1119 Automated Collection
- T1102.001 Dead Drop Resolver
- T1680 Local Storage Discovery
- T1059.003 Windows Command Shell
- T1027.001 Binary Padding
- T1548.002 Bypass User Account Control
- T1059.001 PowerShell
- T1598.003 Spearphishing Link
- T1105 Ingress Tool Transfer
- T1566.002 Spearphishing Link
- T1082 System Information Discovery
- T1559.002 Dynamic Data Exchange
ATT&CK technique IDs (denormalized)
- T1005
- T1021.001
- T1027.001
- T1027.002
- T1027.005
- T1027.010
- T1033
- T1036.005
- T1053.005
- T1055.012
- T1059.001
- T1059.003
- T1059.005
- T1070.004
- T1074.001
- T1082
- T1083
- T1102.001
- T1105
- T1112
- T1119
- T1132.001
- T1189
- T1197
- T1203
- T1204.001
- T1204.002
- T1518.001
- T1547.001
- T1548.002
- T1553.002
- T1555.003
- T1559.002
- T1560
- T1566.001
- T1566.002
- T1574.001
- T1587.002
- T1588.002
- T1598.003
- T1680
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- NDiskMonitor (S0272) — malware
- QuasarRAT (S0262) — tool
- BackConfig (S0475) — malware
- TINYTYPHON (S0131) — malware
- AutoIt backdoor (S0129) — malware
- PowerSploit (S0194) — tool
- BADNEWS (S0128) — malware
- Unknown Logger (S0130) — malware
- VajraSpy (S9006) — malware
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [6] Cymmetria Patchwork Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024. [7] Operation Hangover May 2013 Fagerland, S., et al. (2013, May). Operation Hangover: Unveiling an Indian Cyberattack Infrastructure. Retrieved November 17, 2024. [8] Symantec Patchwork Hamada, J.. (2016, July 25). Patchwork cyberespionage group expands targets from governments to wide range of industries. Retrieved August 17, 2016. [9] Unit 42 BackConfig May 2020 Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020. [11] Securelist Dropping Elephant Kaspersky Lab’s Global Research & Analysis Team. (2016, July 8). The Dropping Elephant – aggressive cyber-espionage in the Asian region. Retrieved August 3, 2016. [12] PaloAlto Patchwork Mar 2018 Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018. [13] TrendMicro Patchwork Dec 2017 Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. [14] Volexity Patchwork June 2018 Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018. [16] Forcepoint Monsoon Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.