FORENSIA

THREAT_ACTOR · G0040

Patchwork

Also known as: Patchwork, Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover

Profile

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.

MITRE ATT&CK ↗

Techniques

41 ATT&CK techniques attributed to this actor.

T1005 Data from Local SystemT1021.001 Remote Desktop ProtocolT1027.001 Binary PaddingT1027.002 Software PackingT1027.005 Indicator Removal from ToolsT1027.010 Command ObfuscationT1033 System Owner/User DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1053.005 Scheduled TaskT1055.012 Process HollowingT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1070.004 File DeletionT1074.001 Local Data StagingT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1112 Modify RegistryT1119 Automated CollectionT1132.001 Standard EncodingT1189 Drive-by CompromiseT1197 BITS JobsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1518.001 Security Software DiscoveryT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account ControlT1553.002 Code SigningT1555.003 Credentials from Web BrowsersT1559.002 Dynamic Data ExchangeT1560 Archive Collected DataT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1574.001 DLLT1587.002 Code Signing CertificatesT1588.002 ToolT1598.003 Spearphishing LinkT1680 Local Storage Discovery

Software

8 malware/tools attributed to this actor.

BADNEWSAutoIt backdoorUnknown LoggerTINYTYPHONPowerSploitQuasarRATNDiskMonitorBackConfig

Related corpus activity

10,313 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Patchwork.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2025-11837cve—852
cve-2014-2321cve—851
cve-2025-2492cve—852
cve-2021-29441cve—851
cve-2025-0921cve—852
cve-2013-3307cve—852
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-22658cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2016-5681cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2022-47945cve—851
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2025-23304cve—852
cve-2023-44976cveransomware852
cve-2020-17456cve—851
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,313.