MITRE ATT&CKgroup
G0040 Patchwork
- Domain
- enterprise, mobile
- Aliases
- Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover
- Version
- 1.7
- Created
- 2017-05-31
Description
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.
Related
Uses · MITRE ATT&CK (50)
- S9006 VajraSpy software (malware)
- T1680 Local Storage Discovery technique
- T1027.010 Command Obfuscation sub-technique
- T1598.003 Spearphishing Link sub-technique
- T1587.002 Code Signing Certificates sub-technique
- T1588.002 Tool sub-technique
- S0475 BackConfig software (malware)
- T1027.005 Indicator Removal from Tools sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1132.001 Standard Encoding sub-technique
- T1074.001 Local Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560 Archive Collected Data technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1559.002 Dynamic Data Exchange sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.001 Binary Padding sub-technique
- T1027.002 Software Packing sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
References
- https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf Cymmetria Patchwork
- https://web.archive.org/web/20140424084220/http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf Operation Hangover May 2013
- http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries Symantec Patchwork
- https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/ Unit 42 BackConfig May 2020
- https://securelist.com/the-dropping-elephant-actor/75328/ Securelist Dropping Elephant
- https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/ PaloAlto Patchwork Mar 2018
- https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf TrendMicro Patchwork Dec 2017
- https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/ Volexity Patchwork June 2018
- https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf Forcepoint Monsoon