Patchwork (Dropping Elephant, Chinastrats, MONSOON, Hangover Group), Adversary Emulation Profile

Patchwork (MITRE ATT&CK G0040) is a cyber-espionage group believed to operate from India, active since at least 2009 and first publicly documented in December 2015. The group earned its name because much of the code used in its tooling is copied and pasted from online forums and public repositories, a "patchwork" of borrowed exploit code and open-source RATs stitched together with custom malware. Despite this low-sophistication approach, Patchwork compensates with high-quality social engineering and aggressive targeting of diplomatic, government, defense, and research organizations primarily across South Asia, with heavy emphasis on Pakistan and China's foreign relations apparatus. The group's malware arsenal includes the custom BADNEWS RAT (and its Ragnatela variant), the public QuasarRAT, BackConfig, VajraSpy (Android), and multiple document exploit chains leveraging CVE-2017-11882, CVE-2017-0199, CVE-2012-0158, and EPS vulnerabilities.

Attribution & motivation