Patchwork

Patchwork is an advanced persistent threat group associated in the provided content with cyberespionage activity. Known aliases include APT-C-09, Chinastrats, Dropping Elephant, Hangover Group, Monsoon, Operation Hangover, Quilted Tiger, and Zinc Emerson. The content attributes to Patchwork with high confidence an Android espionage campaign involving 12 trojanized apps carrying the VajraSpy RAT, including apps distributed through Google Play and others found in the wild. That campaign primarily targeted users in Pakistan, likely using honey-trap romance scams, and ESET assessed Pakistan as the primary target; exposed victim data also indicated compromised devices in Pakistan and India. The VajraSpy tooling supported theft of contacts, SMS messages, call logs, files, location data, installed app lists, and notifications, while advanced variants could intercept WhatsApp, WhatsApp Business, and Signal communications, record calls and ambient audio, log keystrokes, and take photos. Multiple samples used Google Firebase-hosted infrastructure as command-and-control. Across the provided ATT&CK-style reporting, Patchwork has used spearphishing with malicious attachments for initial access. On Windows systems, the group has used Base64-encoded C2 traffic, collected victim computer name, OS version, and architecture, collected and exfiltrated files, and copied targeted files into a staging directory named index before upload to C2. Reported persistence mechanisms include adding second-stage malware to the Startup folder, using Registry Run keys, and using a TaskScheduler DLL. Patchwork has used JavaScript code and .SCT files, PowerSploit to download payloads, execute malware, and run a reverse shell, and has run a Meterpreter reverse shell. The group has obtained and used open-source tools including QuasarRAT. Masquerading examples in the content include payloads installed as "Baidu Software Update" and "Net Monitor," and QuasarRAT binaries dropped as microsoft_network.exe and crome.exe. Additional behaviors directly mentioned include dumping Chrome credentials from \AppData\Local\Google\Chrome\User Data\Default\Login Data, deleting Microsoft Office Resiliency Registry keys to hide application issues from users, removing and replacing files so they could not be retrieved, and use of RDP for lateral movement.