Patchwork is a long-running espionage group that wins with old Office exploits, copied code and convincing lures, which means any organisation still opening unpatched RTF and Office files from email is in its reach. Researchers have tracked it since late 2015 under names such as Dropping Elephant, Chinastrats and MONSOON, and its targets cluster around governments, defence, diplomacy, think tanks and universities with an interest in South Asia and China. This profile is for SOC analysts, email and endpoint engineers and threat intelligence teams in those sectors. It covers the names and attribution exactly as each source states them, the ATT&CK techniques mapped to the group, how it uses stolen credentials and trusted signatures, notable campaigns, and a detection and hardening plan. General background on how groups are named and tracked is in the Threat Actor Groups Guide.
Key takeaways
- Old exploits still work for it. ATT&CK lists CVE-2012-0158, CVE-2014-4114, CVE-2017-0199 and CVE-2017-8570 among the flaws Patchwork has exploited, and Malwarebytes saw Equation Editor RTF exploits in late 2021. All are in the CISA Known Exploited Vulnerabilities catalogue.
- Lures are copied from real organisations. Volexity saw 2018 emails that reused genuine think tank content from CFR, CSIS and MERICS; Malwarebytes saw documents impersonating Pakistani authorities.
- It tracks who opens its mail. Per-recipient tracking images (web bugs) let the operators see which targets open messages before sending the payload.
- Tooling is a mix of custom and open source. BADNEWS (including the Ragnatela variant), AutoIt backdoors, QuasarRAT, PowerSploit and Meterpreter all appear in public reporting.
- Patching Office and blocking macros removes most of the chain. Disabling Equation Editor, enforcing Office updates and controlling DLL side-loading address the techniques this group repeats.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as Patchwork (G0040), a cyber espionage group first observed in December 2015. ATT&CK states that the group has not been definitively attributed, but that circumstantial evidence suggests it may be a pro-Indian or Indian entity, and that much of its code was copied and pasted from online forums. Kaspersky described Dropping Elephant in 2016 as likely operating from India, noting attacker logins through VPNs and sometimes an ordinary Indian ISP. Volexity called Patchwork an Indian APT group, and Malwarebytes described it as an Indian threat actor, citing the dual English and Indian keyboard layouts on the operator's own machine. No government attribution has been published in the sources reviewed for this page, so treat these as vendor assessments.
| Name | Tracked by | Notes |
|---|---|---|
| Patchwork | ATT&CK, Volexity, Malwarebytes | Most common public name; named for its copy and paste code |
| Dropping Elephant, Chinastrats | Kaspersky | Kaspersky reported activity since at least November 2015 |
| MONSOON | Forcepoint | Listed as an alias in ATT&CK |
| Hangover Group, Operation Hangover | Norman (2013), listed in ATT&CK | ATT&CK groups the 2013 Hangover reporting with Patchwork |
| Hangover (also Neon, Viceroy Tiger) | Palo Alto Networks Unit 42 | Unit 42 attributed BackConfig to Hangover; ATT&CK maps BackConfig to Patchwork |
Vendors do not all draw the cluster boundary in the same place. Unit 42's BackConfig report uses the Hangover name and does not mention Patchwork, while ATT&CK merges the two. Keep the vendor's own name in your intelligence records so a later split does not corrupt your history. South Asian activity is also often confused with SideWinder, which uses similar lures and exploits but is tracked separately.
Targeting and motivation
- Government and diplomacy: ATT&CK and Kaspersky describe diplomatic and government targets, with Kaspersky linking victims to China's foreign relations.
- Pakistan: Malwarebytes reports that Patchwork usually targets Pakistan; in late 2021 victims included Pakistan's Ministry of Defence, a national defence university and several universities and research institutes, including faculty in molecular medicine and biological sciences.
- Think tanks: Volexity observed three campaigns in March and April 2018 against US think tanks, with lures built around CFR, CSIS, MERICS and FPRI branding.
- South Asian government and military (Hangover cluster): Unit 42 saw BackConfig delivered to a government department and a military organisation in South Asia, with lures themed on Pakistani government programmes and files hosted on compromised sites in Pakistan, Bangladesh and the Maldives.
- Motivation: intelligence collection. The tooling focuses on document theft, keylogging, screenshots and browser credentials rather than disruption or financial gain.
Tactics and techniques (MITRE ATT&CK)
All techniques below are mapped to G0040 in ATT&CK v20. Software mapped to the group includes BADNEWS (S0128), BackConfig (S0475), NDiskMonitor (S0272), TINYTYPHON (S0131), AutoIt backdoor (S0129), Unknown Logger (S0130), QuasarRAT (S0262) and PowerSploit (S0194).
| Tactic | Technique | How it shows up |
|---|---|---|
| Reconnaissance | T1598.003 Spearphishing Link | Zero-size tracking images with per-recipient identifiers |
| Resource development | T1587.002 Code Signing Certificates; T1588.002 Tool | Self-signed certificates in the names of real or fictitious software firms; QuasarRAT and other open-source tools |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1189 Drive-by Compromise | RTF and Office attachments, links to lookalike or compromised sites, fake news sites serving PowerPoint files |
| Execution | T1203 Exploitation for Client Execution; T1204.002 Malicious File; T1559.002 Dynamic Data Exchange | Office and OLE exploits, macros behind a "click the icon" lure, DDE delivery |
| Execution | T1059.001 PowerShell; T1059.005 Visual Basic; T1059.003 Windows Command Shell | PowerSploit downloads, VBS on victims, reverse shells |
| Persistence | T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder | Volexity saw a task named Microsoft_Security_Task; startup entries such as "Baidu Software Update" and "Net Monitor" |
| Stealth, persistence | T1197 BITS Jobs; T1574.001 DLL side-loading | BITS downloads of payloads; BADNEWS loaded through a signed executable and a planted DLL |
| Privilege escalation | T1548.002 Bypass User Account Control; T1055.012 Process Hollowing | UAC bypass hidden inside a hollowed svchost.exe |
| Stealth | T1036.005 Match Legitimate Name or Location; T1553.002 Code Signing | Software update names and signed binaries to blend in |
| Credential access | T1555.003 Credentials from Web Browsers | Chrome Login Data database copied from the user profile |
| Collection | T1119 Automated Collection; T1074.001 Local Data Staging | File stealers sweeping drives for document extensions into a staging folder |
| Command and control | T1102.001 Dead Drop Resolver; T1132.001 Standard Encoding | Encrypted C2 addresses hidden in comments on legitimate websites; Base64 traffic |
| Lateral movement | T1021.001 Remote Desktop Protocol | Attempts to move by RDP |
The exploited vulnerabilities are the most useful detail for defenders, because each one has a patch and a known detection.
| CVE | Product | CISA KEV | Where reported |
|---|---|---|---|
| CVE-2012-0158 | MSCOMCTL.OCX (Office) | Yes | Kaspersky, ATT&CK |
| CVE-2014-4114 | Windows OLE | Yes | ATT&CK |
| CVE-2017-0199 | Office and WordPad | Yes | ATT&CK |
| CVE-2017-8570 | Office (Composite Moniker) | Yes | Volexity, ATT&CK |
| CVE-2017-11882 | Office Equation Editor | Yes | Unit 42 (Hangover BackConfig RTF); Malwarebytes describes an Equation Editor exploit |
How they abuse identities and credentials
Patchwork does not depend on directory attacks. Its identity abuse is quieter: harvesting what the user's browser remembers, logging into stolen mailboxes and borrowing trust from code signatures and real brands.
| Trust abused | What the actor does | Control that limits it |
|---|---|---|
| Saved browser passwords | Copies the Chrome Login Data database (T1555.003); Kaspersky saw Chrome credential theft in 2016 | Disable browser password saving on managed devices through policy; use an enterprise password manager with phishing-resistant MFA |
| Stolen mailbox and web accounts | Malwarebytes observed the operators logging into victims' stolen email and other accounts through VPN services | Conditional access, impossible-travel and anonymising VPN detection, rapid session revocation after any endpoint infection |
| Code signing | Self-signed certificates impersonating vendors such as Foxit and NVIDIA (Unit 42) | Application control that trusts specific publishers, not any signature; alert on self-signed binaries in user-writable paths |
| Brand and sender trust | Copied think tank content and government forms; lookalike domains | DMARC enforcement for your own domains, lookalike domain monitoring, external sender tagging |
| The user's local rights | UAC bypass to gain elevated rights | Remove local admin from users; set UAC to always notify; manage local admin passwords with LAPS |
For the wider session theft problem, see the AiTM Phishing Guide.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| 2013 | Operation Hangover report on an Indian attack infrastructure; ATT&CK groups it with Patchwork | Norman, via ATT&CK |
| November 2015 to 2016 | Dropping Elephant campaigns against diplomatic and economic targets with watering-hole news sites and Office exploits | Kaspersky, 8 July 2016 |
| March to April 2018 | Three spearphishing campaigns against US think tanks delivering QuasarRAT via CVE-2017-8570 | Volexity, 7 June 2018 |
| 2017 to 2020 | BackConfig delivered to South Asian government and military targets through compromised sites and macro-laden XLS files | Unit 42, 11 May 2020 (named Hangover) |
| November to December 2021 | Ragnatela (BADNEWS variant) campaign against Pakistan's Ministry of Defence, universities and researchers; operators infected their own machine | Malwarebytes, 7 January 2022 |
Detection and defence
Detection signals
| Signal | Where to look | Notes |
|---|---|---|
| EQNEDT32.EXE starting at all | Process creation (Event ID 4688, Sysmon 1) | Equation Editor should not run on patched estates; any execution is suspicious |
| WINWORD.EXE or EXCEL.EXE spawning cmd.exe, wscript.exe, powershell.exe or bitsadmin.exe | EDR process trees | Exploit or macro execution |
| New scheduled tasks with security or update style names | Event ID 4698, Sysmon 1 for schtasks.exe | Volexity's Microsoft_Security_Task is the pattern |
| BITS jobs created by non-system processes | Microsoft-Windows-Bits-Client/Operational log (Event IDs 3, 59) | Payload download |
| A signed executable loading a DLL from the same user-writable folder | Sysmon Event ID 7 (image load) | DLL side-loading, as with the Ragnatela jli.dll loader |
| Non-browser processes reading Chrome Login Data | EDR file access telemetry | Browser credential theft |
| Mailbox sign-ins from commercial VPN ranges after a suspected infection | Identity provider sign-in logs | Stolen account reuse |
| Startup folder or Run key entries named as software updates | Sysmon Event ID 13, autoruns baselines | Masquerading persistence |
Hardening plan
- Week 1: confirm every Office installation is on a supported, patched build so the KEV-listed CVEs above are closed; confirm Equation Editor is removed. Load current vendor indicators into protective DNS and mail filtering.
- Weeks 2 to 4: block macros in files from the internet by policy (see the Office Macro Blocking Guide) and turn on attack surface reduction rules that block Office child processes, in audit mode for two weeks before enforcing.
- Weeks 4 to 8: apply application control to user-writable paths so unsigned or self-signed binaries and side-loaded DLLs cannot run. Pilot on one department, keep the previous policy ready for rollback, and review blocked events daily.
- Quarter 1: disable browser password storage on managed devices, remove standard users' local admin rights and enforce phishing-resistant MFA for mail and VPN.
- Response: isolate the host, collect scheduled tasks, Run keys, BITS jobs and staging folders, then reimage. Revoke the user's sessions, reset every password saved in the browser and review mailbox sign-ins for the previous 90 days.
Metrics
- Office builds with all KEV-listed Office CVEs patched: 100%.
- Equation Editor executions per month: zero.
- Endpoints with internet macros blocked by policy: 100%.
- Managed browsers with password saving disabled or controlled: trending to 100%.
- Time from endpoint alert to user session revocation: under one hour.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-2 Flaw Remediation, CM-6 Configuration Settings | Office patching and macro settings |
| NIST SP 800-53 Rev. 5 | SI-3 Malicious Code Protection, SI-4 System Monitoring | Email and endpoint scanning and process monitoring |
| NIST SP 800-53 Rev. 5 | IA-5 Authenticator Management, AT-2 Literacy Training and Awareness | Browser credential handling and phishing awareness |
| NIST CSF 2.0 | PR.AT-01, DE.CM-09, DE.AE-02 | Awareness, endpoint monitoring, alert analysis |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-DNSDL DNS Denylisting | Blocking side-loaded binaries and known C2 |
Practitioner checklist
- Verify no Office build in the estate is exposed to CVE-2017-11882, CVE-2017-0199, CVE-2017-8570 or older KEV-listed Office flaws.
- Alert on any EQNEDT32.EXE execution and on Office applications spawning script hosts or bitsadmin.
- Enforce macro blocking for internet files through policy, not user choice.
- Hunt for signed executables loading DLLs from user-writable folders.
- Disable or centrally control browser password storage.
- Tag external mail and monitor lookalike domains of your organisation and partners.
- After any infection, revoke sessions and reset browser-saved credentials, not only the Windows password.
- Record vendor names (Patchwork, Hangover, Dropping Elephant) separately in your intelligence platform.
Standards and references
- MITRE ATT&CK: Patchwork (G0040)
- MITRE ATT&CK: Exploitation for Client Execution
- CISA: Known Exploited Vulnerabilities Catalog
- Volexity: Patchwork APT Group Targets US Think Tanks
- Kaspersky Securelist: The Dropping Elephant actor
- Palo Alto Networks Unit 42: Updated BackConfig Malware Targeting Government and Military Organizations in South Asia
- Malwarebytes ThreatDown: Patchwork APT caught in its own web
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Sidewinder Threat Actor Profile Guide · Office Macro Blocking Guide · Phishing Guide · AiTM Phishing Guide