Patchwork APT: Leveraging PowerShell to Create Scheduled Tasks and Deploy Final Payload

Patchwork, the advanced persistent threat actor also known as Dropping Elephant, Monsoon, and Hangover Group, has been observed deploying a new PowerShell-based loader that abuses Windows Scheduled Tasks to execute its final payload. Active since at least 2015 and focused on political and military intelligence across South and Southeast Asia, Patchwork is noted for its persistence and its habit of repurposing existing tools rather than developing new exploits.

In the latest campaign, targets receive a Microsoft Office document containing a malicious macro; when enabled, the macro downloads an LNK shortcut file that, once opened, executes a PowerShell script.

The loader then downloads an executable masquerading as vlc.exe into C:\Windows\Tasks\lama, retrieves a DLL named libvlc.dll to side-load with vlc.exe, places a decoy PDF in the Public Documents folder, creates a scheduled task called WindowsErrorReport that triggers vlc.exe at intervals, and finally downloads the final payload, a .NET-based executable compiled with MSIL.

The campaign also includes multi-stage command and control, with data obfuscation, TLS 1.2 HTTPS POSTs to a C2 server, and ongoing attempts to maintain persistence and exfiltrate information.