Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.1 234
- Cymmetria Patchwork
- Symantec Patchwork
- TrendMicro Patchwork Dec 2017
- Volexity Patchwork June 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Patchwork | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Hangover Group | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Dropping Elephant | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Chinastrats | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | MONSOON | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Operation Hangover | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1197 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| also_known_as | 毒云藤 | — → … | 60 | src_0e0b2199-b766-47ad-af5a-891db001f83e |
| also_known_as | 摩诃草 | — → … | 60 | src_0e0b2199-b766-47ad-af5a-891db001f83e |
| also_known_as | 白象 | — → … | 60 | src_0e0b2199-b766-47ad-af5a-891db001f83e |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.001 | Binary Padding | — |
| T1027.002 | Software Packing | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1053.005 | Scheduled Task | — |
| T1055.012 | Process Hollowing | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1070.004 | File Deletion | — |
| T1074.001 | Local Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1102.001 | Dead Drop Resolver | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1119 | Automated Collection | — |
| T1132.001 | Standard Encoding | — |
| T1189 | Drive-by Compromise | — |
| T1197 | BITS Jobs | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1518.001 | Security Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1553.002 | Code Signing | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560 | Archive Collected Data | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1574.001 | DLL | — |
| T1587.002 | Code Signing Certificates | — |
| T1588.002 | Tool | — |
| T1598.003 | Spearphishing Link | — |
| T1680 | Local Storage Discovery | — |
Aliases
Chinastrats · Dropping Elephant · Hangover Group · MONSOON · Operation Hangover · Patchwork · 摩诃草 · 毒云藤 · 白象
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.