patchwork-dropping-elephant

• SKILL.mdcore · 27,152 bytes
• SKILL.mdcore · 27,152 bytes
• SKILL.mdcore · 27,152 bytes
• SKILL.mdcore · 27,152 bytes
• SKILL.mdcore · 27,152 bytes

# Patchwork (Dropping Elephant, Chinastrats, MONSOON, Hangover Group) — Adversary Emulation Profile

Patchwork (MITRE ATT&CK **G0040**) is a cyber-espionage group believed to operate from India, active since at least **2009** and first publicly documented in December 2015. The group earned its name because much of the code used in its tooling is **copied and pasted from online forums and public repositories** — a "patchwork" of borrowed exploit code and open-source RATs stitched together with custom malware. Despite this low-sophistication approach, Patchwork compensates with **high-quality social engineering** and aggressive targeting of diplomatic, government, defense, and research organizations primarily across South Asia — with heavy emphasis on **Pakistan** and **China's foreign relations apparatus**. The group's malware arsenal includes the custom BADNEWS RAT (and its Ragnatela variant), the public QuasarRAT, BackConfig, VajraSpy (Android), and multiple document exploit chains leveraging CVE-2017-11882, CVE-2017-0199, CVE-2012-0158, and EPS vulnerabilities.

## Attribution & motivation

- **Sponsor / nation:** India (suspected state-sponsored). Circumstantial evidence — Indian keyboard layouts, IP geolocation, infrastructure registration patterns, and targeting profile — consistently points to a pro-Indian or Indian state entity. Norman Shark's 2013 Operation Hangover report traced infrastructure ownership to Indian firms. No formal government attribution has been issued, but multiple vendors (Kaspersky, Symantec, Palo Alto Unit 42, Trend Micro, Malwarebytes, ESET, Cymmetria, Forcepoint, Volexity) converge on an Indian nexus.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** — military, diplomatic, and political intelligence relevant to Indian national security interests. Targets align with Indian geopolitical priorities: Pakistani military/defense/nuclear programs, Chinese diplomatic activities, and Western think tanks covering South Asian policy.
- **Attribution confidence:** **Medium-High.** No government indictments or formal attributions, but consistent vendor consensus plus the 2022 self-compromise (the actor infected their own machine with Ragnatela, revealing Indian keyboard layouts and development environment) significantly reinforce the India attribution.

## Targeting

- **Sectors:** Government and diplomatic bodies; defense and military organizations; nuclear/atomic energy agencies; think tanks and policy research institutes; universities and scientific research (molecular medicine, biological sciences); telecommunications; media and journalists covering South Asian affairs.
- **Regions:** Primary focus on **Pakistan** (military, government, defense, atomic energy, universities), **China** (diplomatic and government entities, foreign affairs), **Bangladesh**, **Sri Lanka**, **Nepal**, and **Southeast Asia**. Secondary targets include **United States** (think tanks — e.g., US-based foreign policy organizations), **United Kingdom**, **Australia**, and Western nations with diplomatic ties to South Asia.