Patchwork

Patchwork is a cyber espionage threat actor widely assessed to originate from India. The group is also tracked as Dropping Elephant, Operation Hangover, Chinastrats, Monsoon, Quilted Tiger, APT-C-09, Patchwork APT, and Zinc Emerson. It has historically focused on regional strategic and political targets, with reporting linking its activity to victims in China and Pakistan as well as additional targets in South Asia and occasional broader international targeting. Patchwork commonly relies on spearphishing with malicious attachments for initial access. Post-compromise tradecraft includes downloading additional payloads from command-and-control infrastructure, use of PowerShell and Visual Basic or VBScript components for execution, and DLL side-loading to launch malicious code through legitimate executables. The group has also used reverse shells and commodity or publicly available tooling in support of operations. Observed Patchwork capabilities include host reconnaissance and victim profiling, such as collecting computer name, operating system version, architecture, username, privilege context, and available drives. It has searched local drives for files of interest and exfiltrated collected data. Credential access activity includes theft of browser-stored credentials, including extraction of Chrome login data. For persistence, Patchwork has used startup-folder mechanisms and scheduled-task-related components. Defense evasion and anti-forensics behaviors include Base64-encoded command-and-control traffic, deletion or replacement of files, and removal of Microsoft Office resiliency artifacts to reduce visible signs of malicious document execution. Patchwork is best characterized as an espionage-oriented intrusion set conducting targeted collection operations rather than financially motivated ransomware or extortion activity.