Patchwork APT Resurfaces: Stealthy Espionage Campaign Exploits DLL Sideloading and Layered Obfuscation

Patchwork APT, also known as Dropping Elephant, Monsoon, and Hangover Group, has resurfaced with a campaign aimed at South and Southeast Asia, according to K7 Security Labs. The researchers note that Patchwork has been active since at least 2015 and focuses on political and military intelligence, using a Windows macro that downloads a LNK file to trigger a PowerShell script delivering multiple components.

It masquerades a VLC media player process by saving itself as C:\Windows\Tasks\lama and then downloads a DLL that mimics VLC’s libvlc.dll to enable DLL sideloading during execution, with a decoy PDF also downloaded to distract the user and a WindowsScheduled Task named WindowsErrorReport for persistence.

The malware uses a staged approach to contact a C2 server, encoding the victim’s ID through XOR, base64, and Protean-based obfuscation to protect exfiltrated data such as system details, IP address, and credentials. It collects installed software and antivirus information via WMI and disguises C2 traffic as normal web form submissions. Patchwork’s toolkit also supports downloading and executing files, uploading data in chunks, in-memory code execution, and screenshot capture from connected monitors.