# Patchwork Dropping Elephant

Adversary-emulation profile for Patchwork (G0040 / Dropping Elephant / Chinastrats /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill patchwork-dropping-elephant -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill patchwork-dropping-elephant -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill patchwork-dropping-elephant -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill patchwork-dropping-elephant -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Patchwork (G0040 / Dropping Elephant / Chinastrats / MONSOON / Hangover Group / Operation Hangover), an India-linked cyber-espionage actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Patchwork (Dropping Elephant, Chinastrats, MONSOON, Hangover Group), Adversary Emulation Profile

Patchwork (MITRE ATT&CK **G0040**) is a cyber-espionage group believed to operate from India, active since at least **2009** and first publicly documented in December 2015. The group earned its name because much of the code used in its tooling is **copied and pasted from online forums and public repositories**, a "patchwork" of borrowed exploit code and open-source RATs stitched together with custom malware. Despite this low-sophistication approach, Patchwork compensates with **high-quality social engineering** and aggressive targeting of diplomatic, government, defense, and research organizations primarily across South Asia, with heavy emphasis on **Pakistan** and **China's foreign relations apparatus**. The group's malware arsenal includes the custom BADNEWS RAT (and its Ragnatela variant), the public QuasarRAT, BackConfig, VajraSpy (Android), and multiple document exploit chains leveraging CVE-2017-11882, CVE-2017-0199, CVE-2012-0158, and EPS vulnerabilities.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/patchwork/SKILL.md