Patchwork APT Deploys StreamSpy Trojan, Hiding C2 Commands in WebSocket Traffic for Stealth Espionage

The Patchwork APT group, also known as Bai Xiang or “White Elephant”, is behind a new campaign that uses a sophisticated Trojan named StreamSpy to achieve stealthy espionage. Active since at least 2009, Patchwork typically targets government, military and industrial sectors across Asia.

According to Qi’anxin Threat Intelligence Center, StreamSpy distinguishes itself by using a combination of WebSocket and HTTP protocols to evade traditional network detection, with command and control traffic hidden inside normal web activity. The malware arrives as a ZIP file (for example OPS-VII-SIR[.]zip) containing an executable that mimics a PDF icon to entice victims.

Once on a system, StreamSpy decrypts configuration data from its resource section, including network C2 details, identity tags and persistence settings, and splits its communications into WebSocket for commands and results and HTTP for file transfer.

It collects device data such as hostname, username, operating system version and antivirus details, and supports a range of commands including terminal_input, file operations using codes, and information gathering, while using several persistence methods like scheduled tasks, RunOnce keys and LNK files in the Startup directory.