ETDA ThaiCERT
Report
Search
Home > List all groups > Patchwork, Dropping Elephant

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Patchwork, Dropping Elephant

NamesPatchwork (Cymmetria)
Dropping Elephant (Kaspersky)
Chinastrats (Kaspersky)
APT-C-09 (Qihoo 360)
Monsoon (Forcepoint)
Quilted Tiger (CrowdStrike)
ATK 11 (Thales)
CountryIndia India
MotivationInformation theft and espionage
First seen2013
Description(Cymmetria) Patchwork is a targeted attack that has infected an estimated 2,500 machines since it was first observed in December 2015. There are indications of activity as early as 2014, but Cymmetria has not observed any such activity first hand.

Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments, and specifically those working on issues relating to Southeast Asia and the South China Sea. Many of the targets were governments and government-related organizations.

The code used by this threat actor is copy-pasted from various online forums, in a way that reminds us of a patchwork quilt –hence the name we’ve given the operation.

In active victim systems, Patchwork immediately searches for and uploads documents to their C&C, and only if the target is deemed valuable enough, proceeds to install a more advanced second stage malware.

This group seems to be associated with Confucius.
ObservedSectors: Aviation, Defense, Energy, Financial, Government, IT, Media, NGOs, Pharmaceutical, Think Tanks.
Countries: Bangladesh, China, Israel, Japan, Pakistan, South Korea, Sri Lanka, UK, USA and Middle East and Southeast Asia.
Tools usedAndroRAT, ArtraDownloader, AutoIt backdoor, BADNEWS, Bahamut, NDiskMonitor, PowerSploit, QuasarRAT, SocksBot, TINYTYPHON, Unknown Logger, WSCSPL.
Operations performed2015The attack was detected as part of a spear phishing against a government organization in Europe in late May 2016. The target was an employee working on Chinese policy research and the attack vector was a PowerPoint presentation file. The content of the presentation was on issues relating to Chinese activity in the South China Sea.
<https://s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf>
Jan 2018The malicious documents seen in recent activity refer to a number of topics, including recent military promotions within the Pakistan Army, information related to the Pakistan Atomic Energy Commission, as well as Pakistan’s Ministry of the Interior.
<https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/>
Mar 2018Targeting US Think Tanks
In March and April 2018, Volexity identified multiple spear phishing campaigns attributed to Patchwork, an Indian APT group also known as Dropping Elephant. This increase in threat activity was consistent with other observations documented over the last few months in blogs by 360 Threat Intelligence Center analyzing attacks on Chinese organizations and Trend Micro noting targets in South Asia.
<https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/>
Information<https://s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf>
<https://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries>
<https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf>
<https://securelist.com/the-dropping-elephant-actor/75328/>
<https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf>
MITRE ATT&CK<https://attack.mitre.org/groups/G0040/>
Playbook<https://pan-unit42.github.io/playbook_viewer/?pb=patchwork>

Last change to this card: 22 April 2020

Download this actor card in PDF or JSON format

Previous: PassCV
Next: PittyTiger, Pitty Panda

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key