Patchwork

Patchwork is an espionage threat actor also referred to as APT-C-09, Chinastrats, Dropping Elephant, Hangover Group, Monsoon, Operation Hangover, Quilted Tiger, and Zinc Emerson. The provided content links Patchwork to Indian interests: one source states that Phronesis Partners, co-founded by retired Indian military cyber specialists, has been linked to Monsoon and Patchwork campaigns, and other reporting cited in the content describes Operation Hangover as involving surveillance against targets of interest to Indian national security and industrial espionage. The actor is described as using spearphishing and malicious documents for initial access and execution, including embedding malicious macros in Word documents and luring victims to click icons to execute malware. Rapid7 attributed a renewed Dropping Elephant campaign to this actor, using a China-themed decoy and a malicious LNK file that launched PowerShell to stage malware, abused Fondue.exe for DLL side-loading of APPWIZ.cpl, decrypted additional payloads, and loaded a memory-resident RAT. Reported capabilities in that campaign included anti-analysis checks, AMSI/WLDP/ETW patching, HTTPS command and control, Base64-encoded and Salsa20-protected traffic, scheduled-task persistence via GoogleErrorReport, command execution, screenshot capture, file upload/download, and shell execution. Across the provided content, Patchwork is also described as conducting file and drive enumeration, searching fixed drives and C:\ for files with targeted extensions, copying targeted files to an index directory for upload, collecting and exfiltrating files, collecting the victim username and whether the process had administrative privileges, and dumping Chrome Login Data from the default Google Chrome profile path. Persistence methods mentioned include adding second-stage malware to the Startup folder and using a Registry Run key. The actor has also used JavaScript, .SCT files, and Meterpreter reverse shells. ESET attributed with high confidence a VajraSpy Android espionage campaign to Patchwork. In that activity, 12 trojanized Android apps, including apps distributed through Google Play, were used for targeted espionage primarily against users in Pakistan. Reported VajraSpy capabilities included theft of contacts, SMS messages, call logs, files, location data, installed app lists, and notifications; more advanced variants could intercept WhatsApp, WhatsApp Business, and Signal communications, record calls and ambient audio, log keystrokes, and take photos.