Patchwork
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.
- ATT&CK ID
- G0040
- Techniques
- 34
- Tools
- 8
Also tracked as Hangover Group · Dropping Elephant · Chinastrats · MONSOON · Operation Hangover
Vulnerabilities it has exploited
- CVE-2012-1856 Microsoft OfficeUnscored · exploited in the wild
- CVE-2014-4114 Microsoft WindowsUnscored · exploited in the wild
- CVE-2015-1641 Microsoft OfficeUnscored · exploited in the wild
- CVE-2017-0199 Microsoft Office and WordPadUnscored · exploited in the wild
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2017-8570 Microsoft OfficeUnscored · exploited in the wild
Techniques
Reconnaissance
Resource Development
Develop CapabilitiesObtain Capabilities
Initial Access
Execution
Scheduled Task/JobCommand and Scripting InterpreterBITS JobsExploitation for Client ExecutionUser ExecutionInter-Process CommunicationHijack Execution Flow
Persistence
Scheduled Task/JobModify RegistryBITS JobsBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationMasqueradingProcess InjectionIndicator RemovalBITS JobsHijack Execution Flow
Defense Impairment
Modify RegistrySubvert Trust Controls
Credential Access
Credentials from Password Stores
Discovery
System Owner/User DiscoverySystem Information DiscoveryFile and Directory DiscoverySoftware DiscoveryLocal Storage Discovery
Lateral Movement
Collection
Data from Local SystemData StagedAutomated CollectionArchive Collected Data
Command and Control
Web ServiceIngress Tool TransferData Encoding
Software
AutoIt backdoor · BADNEWS · BackConfig · NDiskMonitor · PowerSploit · QuasarRAT · TINYTYPHON · Unknown Logger