Threat actor
Patchwork
India · espionage
Tracked by CyberSIXT since 10 Sep 2025
- Articles · all time
- 5
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 2
5 articles from 1 outlet since 10 Sep 2025; the latest 125 days ago.
- Article
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 23 Jun · 09:15 UTC | SecurityOnline | Dropping Elephant hits Asian energy firms via fileless LNK attack |
| Fri 5 Dec 2025 · 00:20 UTC | SecurityOnline | Patchwork APT Deploys StreamSpy Trojan, Hiding C2 Commands in WebSocket Traffic for Stealth Espionage |
| Wed 1 Oct 2025 · 02:55 UTC | SecurityOnline | Patchwork APT Resurfaces: Stealthy Espionage Campaign Exploits DLL Sideloading and Layered Obfuscation |
| Tue 30 Sep 2025 · 14:56 UTC | GBHackers | Patchwork APT: Leveraging PowerShell to Create Scheduled Tasks and Deploy Final Payload |
| Wed 10 Sep 2025 · 07:16 UTC | GBHackers | DarkSamural APT Group Deploys LNK/PDF Malware to Steal Critical Information |
Names and sources
- QUILTED TIGER
- Named by CyberSIXT coverage
- APT-C-09
- Named by Malpedia · quilted_tiger
- ATK11
- Named by Malpedia · quilted_tiger
- Chinastrats
- Named by Malpedia · quilted_tiger
- Dropping Elephant
- Named by Malpedia · quilted_tiger
- G0040
- Named by Malpedia · quilted_tiger
- Monsoon
- Named by Malpedia · quilted_tiger
- Orange Athos
- Named by Malpedia · quilted_tiger
All 32 names
- Patchwork
- Named by Malpedia · quilted_tiger
- QUILTED TIGER
- Named by Malpedia · quilted_tiger
- Sarit
- Named by Malpedia · quilted_tiger
- Thirsty Gemini
- Named by Malpedia · quilted_tiger
- ZINC EMERSON
- Named by Malpedia · quilted_tiger
- APT-C-09
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- ATK11
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Chinastrats
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Dropping Elephant
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- G0040
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Monsoon
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Orange Athos
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Patchwork
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- QUILTED TIGER
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Sarit
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Thirsty Gemini
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- ZINC EMERSON
- Named by MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825
- Chinastrats
- Named by MITRE ATT&CK® · G0040
- Dropping Elephant
- Named by MITRE ATT&CK® · G0040
- Hangover Group
- Named by MITRE ATT&CK® · G0040
- MONSOON
- Named by MITRE ATT&CK® · G0040
- Operation Hangover
- Named by MITRE ATT&CK® · G0040
- Patchwork
- Named by MITRE ATT&CK® · G0040
- Patchwork APT
- Named by CyberSIXT coverage
Attributed facts
- motivation
- espionage (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- origin
- India (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- sector
- Diplomacy (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- sector
- Finance (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- sector
- Military (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- sector
- Private sector (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- sponsor
- India (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- Target country
- Bangladesh (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- Target country
- Pakistan (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
- Target country
- Sri Lanka (MISP Galaxy · 18d473a5-831b-47a5-97a1-a32156299825)
Malware and tools
BADNEWS (MITRE ATT&CK® · G0040) AutoIt backdoor (MITRE ATT&CK® · G0040) Unknown Logger (MITRE ATT&CK® · G0040) TINYTYPHON (MITRE ATT&CK® · G0040) PowerSploit (MITRE ATT&CK® · G0040) QuasarRAT (MITRE ATT&CK® · G0040) NDiskMonitor (MITRE ATT&CK® · G0040) BackConfig (MITRE ATT&CK® · G0040) BadNews (Malpedia · quilted_tiger) Spyder Patchwork (Malpedia · quilted_tiger) Unidentified 125 (RAT, Dropping Elephant) (Malpedia · quilted_tiger)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0040
Persistence
- T1053.005
- Scheduled Task
Stealth
Discovery
- T1033
- System Owner/User Discovery
Lateral Movement
- T1021.001
- Remote Desktop Protocol
Collection
- T1005
- Data from Local System
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Dropping Elephant hits Asian energy firms via fileless LNK attackSecurityOnline
- Patchwork APT Deploys StreamSpy Trojan, Hiding C2 Commands in WebSocket Traffic for Stealth EspionageSecurityOnline
- Patchwork APT Resurfaces: Stealthy Espionage Campaign Exploits DLL Sideloading and Layered ObfuscationSecurityOnline
- Patchwork APT: Leveraging PowerShell to Create Scheduled Tasks and Deploy Final PayloadGBHackers
- DarkSamural APT Group Deploys LNK/PDF Malware to Steal Critical InformationGBHackers · first in our coverage