APT / StateG0040

Patchwork

Also known as: Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity85

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 41

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Spearphishing Link

Resource development

Code Signing Certificates Tool

Initial access

Drive-by Compromise Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Windows Command Shell Visual Basic Exploitation for Client Execution Malicious Link Malicious File Dynamic Data Exchange

Persistence

Registry Run Keys / Startup Folder

Privilege escalation

Bypass User Account Control

Credential access

Credentials from Web Browsers

Discovery

System Owner/User Discovery System Information Discovery File and Directory Discovery Security Software Discovery Local Storage Discovery

Lateral movement

Remote Desktop Protocol

Collection

Data from Local System Local Data Staging Automated Collection Archive Collected Data

Command and control

Dead Drop Resolver Ingress Tool Transfer Standard Encoding

defense-impairment

Modify Registry Code Signing

stealth

Binary Padding Software Packing Indicator Removal from Tools Command Obfuscation Match Legitimate Resource Name or Location Process Hollowing File Deletion BITS Jobs DLL

Exploited vulnerabilities 7

CVEs this group is known to exploit, with the source and confidence of each next to it. Ordered by confidence and real-world severity.

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-0199HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2015-1641HIGHEPSS 97%KEV MITRE ATT&CK

CVE-2017-8570HIGHEPSS 90%KEV MITRE ATT&CK

CVE-2014-4114HIGHEPSS 82%KEV MITRE ATT&CK

CVE-2014-6352HIGHEPSS 77%KEV MITRE ATT&CK

CVE-2012-1856HIGHEPSS 72%KEV MITRE ATT&CK

Known infrastructure 630

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port185.7.214.167:9909Quasar RATthreatfox

ip:port143.246.203.148:8080Quasar RATthreatfox

ip:port134.122.191.154:5000Quasar RATthreatfox

sha1_hash8b4840cd84c60df38584e864e9372e51cc78a354Quasar RATthreatfox

md5_hashe074620f5aa2a6f32fdde28eee5c8c21Quasar RATthreatfox

sha256_hash6da7723b6964c0c7165bb57ddce18156668b0b94bc67b1aa2f4ec5fecc5ec0b6Quasar RATthreatfox

sha1_hashb375573147ad807699ebc696fc35b01d0298c99dQuasar RATthreatfox

md5_hash457013a94eefd116aeb5dd4762c3c44eQuasar RATthreatfox

sha256_hashbfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ffQuasar RATthreatfox

sha256_hashbfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ffQuasarRATmalwarebazaar

sha256_hash6da7723b6964c0c7165bb57ddce18156668b0b94bc67b1aa2f4ec5fecc5ec0b6QuasarRATmalwarebazaar

sha256_hash2fc945ca06f4a5bc5e747757c5e4e227662b82fc2f235adc44d6c84a58c67b02QuasarRATmalwarebazaar

ip:port70.163.121.189:4782Quasar RATthreatfox

sha256_hash8ae9be8826a832aee632cc05d4db71ddfdc522f50d5feab2bf1d6edbe21af20aQuasarRATmalwarebazaar

ip:port191.217.233.144:4782Quasar RATthreatfox

ip:port39.107.48.89:8080Quasar RATthreatfox

sha1_hashac8eec32eca372a7f4f70fef7433989cd02fff40Quasar RATthreatfox

md5_hash1a588ad387ae1cb173d0128b5a3b8973Quasar RATthreatfox

sha256_hasha9c28a31c8ad6fd5315688201f77de358ee52cfa1eb7fc338b243cee59430071Quasar RATthreatfox

domainariktreininger.business-profiles.comQuasar RATthreatfox

sha256_hasha9c28a31c8ad6fd5315688201f77de358ee52cfa1eb7fc338b243cee59430071QuasarRATmalwarebazaar

ip:port103.91.144.201:443Quasar RATthreatfox

sha256_hash4689a824b8d338949996ab54d6dce23c53ad9cd70357acec2fc693f27e5601eeQuasarRATmalwarebazaar

sha256_hash02e1bfbf151148ad8bb5f57373bb27f70e355bd633ed2a4c523af9c8a897454cQuasarRATmalwarebazaar

sha256_hashf2c56b981ecc9c9881e23f27dc2ec746d925ca658dd854044b996ae20c8989a2Quasar RATthreatfox

urlhttps://dimonpert.com/cim.pngQuasarRATurlhaus

sha256_hashf2c56b981ecc9c9881e23f27dc2ec746d925ca658dd854044b996ae20c8989a2QuasarRATmalwarebazaar

md5_hasha638481cb22f93846b3af0f9f9bb5626Quasar RATthreatfox

sha256_hash0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9bQuasar RATthreatfox

sha1_hash2554426fdfc4effe11c0ed59aff89377958c6c41Quasar RATthreatfox

+630 indicators in total. See them all on the IOCs page.

Patchwork uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →