Patchwork (Dropping Elephant)

Suspected India-linked espionage group (vendor assessment) phishing Pakistani, Chinese and South Asian government, defense and research targets for over a decade, plus Android spyware.

Threat actor profile · Updated Nov 4, 2026

Active: 2009 to June 2026
Origin: India (vendor assessment; no government attribution)
Type: State-sponsored
Affiliates: Operation Hangover / MONSOON (same actor, per Forcepoint and MITRE); shares code-signing certificates and infrastructure with Donot Team (as reported by QiAnXin)
Regions targeted: Pakistan, China, Bhutan, Sri Lanka, Bangladesh, India, Tibet, Türkiye, United States, Norway
MITRE ATT&CK: G0040

What each vendor calls it

CrowdStrike: QUILTED TIGERVICEROY TIGER
Palo Alto Unit 42: Hangover GroupMONSOON
Sophos / Secureworks: ZINC EMERSON
Kaspersky: Chinastrats
Symantec: Dropping ElephantPatchwork

Also known as APT-C-09 Qihoo 360APT-C-35 Qihoo 360ATK11DoNot APTDonot TeamOperation HangoverOrange AthosOrange KalaSaritSectorE02Thirsty Gemini

See this actor in the Threat Actor Rosetta Stone →

Profile

Patchwork is a long-running cyber espionage group focused on South Asia and China, best known to defenders for doing a lot with very little. MITRE ATT&CK says it was first observed in December 2015 and that circumstantial evidence points to a pro-Indian or Indian entity, while stressing the group has not been definitively attributed. Vendors are less cautious: Volexity calls it “an Indian APT group,” Malwarebytes (now ThreatDown) calls it “an Indian threat actor,” and Arctic Wolf says it is suspected to be of Indian origin. No government has publicly attributed Patchwork, so treat India as a vendor assessment, not an established fact.

The group has a lot of names because several vendors found it within months of each other. Kaspersky named it Dropping Elephant (and Chinastrats) in July 2016, Cymmetria’s 2016 report used Patchwork, a name that fits what MITRE describes as a habit of reusing code copied from online forums, and Forcepoint called the campaign MONSOON. Forcepoint judged it highly probable that MONSOON and the actor behind Operation Hangover, a surveillance operation Norman exposed in 2013 after an intrusion at Norwegian telecom Telenor, were one and the same, based on shared infrastructure, tradecraft and victims. MITRE likewise notes Hangover is believed to be run by the same people. CrowdStrike tracks it as QUILTED TIGER, Secureworks as ZINC EMERSON, and QiAnXin as APT-Q-36 (full list above). One caution about that list: MITRE tracks Donot Team as a separate group, and QiAnXin describes Patchwork and Donot as sharing resources such as code-signing certificates, not as the same actor.

Targeting follows the region’s politics. Pakistan’s military, nuclear and government bodies are the most consistent targets, from the Hangover years (ESET found 79 percent of its detections for that malware in Pakistan, according to PCWorld) through Unit 42’s 2018 BADNEWS lures about Pakistan Army promotions and ThreatDown’s 2022 report on attacks against Pakistan’s Ministry of Defense. China is the other main focus: diplomats and think tanks working on Chinese foreign relations in 2016, then Chinese universities and research institutes, aerospace and energy themes in Knownsec, Cyble and Rapid7 reports from 2023 to 2026. Bhutan, Sri Lanka, Bangladesh and Tibet appear too, and the group has reached further when it suited: three think tanks, two of them American, were impersonated in 2018, and in July 2025 Arctic Wolf caught it targeting a Turkish missile manufacturer, timing it links to Türkiye’s defense ties with Pakistan.

The playbook barely changes. Patchwork phishes with topical lures (think-tank articles, conference invitations, government notices), often lifted wholesale from legitimate publications, and for years relied on old Microsoft Office exploits rather than zero-days. Kaspersky’s original report noted it used “no 0 days or advanced techniques,” and Trend Micro described it as rehashing off-the-rack tools. Its signature backdoor, BADNEWS, hides its command-and-control addresses in posts on RSS feeds, forums and GitHub, T1102.001 (Web Service: Dead Drop Resolver), and it leans heavily on signed legitimate programs to side-load malicious DLLs, T1574.001 (Hijack Execution Flow: DLL), a habit visible from 2018 (a VMware binary) to 2026 (VLC and a Microsoft binary). It also runs credential phishing pages spoofing Chinese webmail, according to Trend Micro.

The most interesting shift is quiet modernization since about 2023. Knownsec says the group has shown more appetite for new tooling than its regional peers, counting more than 10 trojans and loading methods; in 2024 it saw Patchwork use the commercial red-team framework Brute Ratel C4 for the first time, alongside a Go backdoor it calls PGoShell. Recent chains start with a shortcut file disguised as a PDF, run PowerShell to pull down a decoy and a loader, set a scheduled task that fires every minute, and decrypt the final implant in memory after patching Windows’ AMSI and ETW defenses. Rapid7’s June 2026 analysis found a reworked RAT with control-flow flattening and anti-VM checks, which it ties to the code Arctic Wolf documented a year earlier. QiAnXin’s StreamSpy trojan, reported in December 2025, moves command traffic onto WebSocket to dodge HTTP inspection.

Patchwork also works on phones. ESET attributes with high confidence the VajraSpy Android spyware, spread through twelve trojanized chat and news apps (six of them on Google Play) using romance-scam lures, with 148 compromised devices geolocated in Pakistan and India. Meta removed about 50 Patchwork accounts on Facebook and Instagram in 2023, according to The Hacker News, for using fake personas to push malicious messaging apps at people in Pakistan, India, Bangladesh, Sri Lanka, Tibet and China.

Two operational security failures stand out. In 2018 Volexity found each phishing email carried a per-recipient tracking image, which shows care about who opened what. Yet in late 2021 the operators infected their own development machine with their Ragnatela RAT, letting ThreatDown watch them work, including an English and Indian dual keyboard layout and logins to accounts stolen from victims.

Events

Date	Target	Narrative	Source
2026-06	Not disclosed (Chinese energy-sector lure)	A shortcut disguised as a contract notice for a Chinese power project runs PowerShell, plants a scheduled task that fires every minute, T1053.005 (Scheduled Task/Job: Scheduled Task), and side-loads a malicious APPWIZ.cpl through a legitimate Microsoft binary. A Donut loader then maps a heavily obfuscated RAT into memory, T1620 (Reflective Code Loading). Rapid7 ties it to Dropping Elephant through code overlaps with the 2025 Turkish campaign.	Rapid7
2025-12	Not disclosed (lures on official reward nominations and terrorism financing)	QiAnXin reports StreamSpy, a trojan hidden in ZIP files that takes commands over WebSocket and moves files over HTTP. It links StreamSpy to Patchwork’s Spyder downloader, and its code-signing certificate to a sample from the Donot group, evidence of shared resources between the two.	QiAnXin
2025-07	Turkish defense contractor making precision-guided missile systems	Spear-phishing with a shortcut posing as an invitation to an unmanned vehicle systems conference in Istanbul, T1204.002 (User Execution: Malicious File). A legitimate VLC player side-loads a malicious libvlc.dll that decrypts shellcode for a RAT able to run commands, upload data and take screenshots. Arctic Wolf links the timing to Türkiye’s defense cooperation with Pakistan.	Arctic Wolf
2025 (first half)	Chinese universities; Chinese power-sector themes	The Hacker News, citing Chinese-language reporting, says Patchwork has hit Chinese universities since early 2025, using power-grid lures to drop a Rust loader for the C# Protego trojan. It also notes QiAnXin’s May 2025 report of infrastructure overlap with Donot Team.	The Hacker News
2024-07 to 2024-09	Chinese aerospace, research and government organizations	Shortcut files, one themed on a COMAC (Commercial Aircraft Corporation of China) innovation week, deliver a DLL side-loaded by WerFaultSecure.exe. Its shellcode patches AMSI and ETW, T1685 (Disable or Modify Tools), before running a new data-stealing implant Cyble calls the Nexe backdoor.	Cyble
2024-07	Entities tied to Bhutan	A shortcut fetches a decoy PDF from a domain impersonating the UN-backed Adaptation Fund, then loads Brute Ratel C4 (its first recorded use by the group) and an enhanced version of the Go backdoor PGoShell.	Knownsec 404
2023-07	Chinese universities and research institutes	Knownsec reports the .NET backdoor EyeShell, found alongside BADNEWS, able to list, upload, download, run and delete files and take screenshots, T1113 (Screen Capture).	Knownsec 404, The Hacker News
2023-05	People in Pakistan, India, Bangladesh, Sri Lanka, Tibet and China	Meta removes Patchwork activity from its platforms (about 50 accounts, per The Hacker News). Meta says the South Asian groups it removed, Patchwork among them, built fake personas posing as recruiters, journalists or military staff, T1585.001 (Establish Accounts: Social Media Accounts), to push low-sophistication malicious apps; The Hacker News says Patchwork’s messaging apps were uploaded to Google Play.	Meta, The Hacker News
2021-04 to 2023-09	Android users, mostly in Pakistan	VajraSpy: twelve trojanized chat and news apps, six on Google Play (more than 1,400 downloads), pushed through romance-scam lures. Depending on the variant, the spyware steals contacts, SMS, call logs, location and files and reads WhatsApp and Signal messages. ESET geolocated 148 compromised devices in Pakistan and India.	ESET
2021-11 to 2021-12	Pakistan’s Ministry of Defense, National Defense University and biology and chemistry faculty at Pakistani universities	A lure exploiting Microsoft Equation Editor drops Ragnatela, a BADNEWS variant with keylogging, T1056.001 (Input Capture: Keylogging), and screenshots. The operators infected their own machine, exposing their VPN use and logins to victims’ stolen accounts.	ThreatDown (Malwarebytes)
2020-01 to 2020-05	Government and military organizations in South Asia	Links to compromised sites hosting macro-laced Excel files themed on Pakistani government housing and the Federal Board of Revenue deliver the BackConfig plug-in backdoor; one RTF used CVE-2017-11882. Unit 42 attributes this to the Hangover group (MONSOON); MITRE lists BackConfig as Patchwork software.	Unit 42
2018-03 to 2018-04	Recipients of three US and European think-tank brands (CFR, CSIS, MERICS)	Three spear-phishing waves copy real think-tank articles about China, embed per-recipient tracking images, and link to RTF files exploiting CVE-2017-8570, T1566.002 (Phishing: Spearphishing Link), which install QuasarRAT.	Volexity
2017 to 2018-01	Pakistani military, nuclear and government interests	Word lures about Pakistan Army promotions, the Pakistan Atomic Energy Commission and the Interior Ministry exploit CVE-2017-0261 and CVE-2015-2545. A signed VMware binary side-loads a DLL that installs BADNEWS, which pulls its C2 address from RSS feeds.	Unit 42
2017	Diplomatic and government agencies and businesses, including Bangladesh Army and UNDP Sri Lanka themes	Trend Micro tracks spoofed news sites that redirect to weaponized documents, typosquatted domains such as a fake RAND site, Office exploits including CVE-2017-0199 and CVE-2017-8570, and a phishing kit spoofing Chinese webmail logins, T1598.003 (Phishing for Information: Spearphishing Link).	Trend Micro
2016-07	Aviation, broadcasting, energy, finance, NGOs, pharmaceutical, publishing and software organizations	Symantec reports the group has widened beyond government targets, with about half of attacks aimed at people in the United States. Newsletters from a legitimate mailing service lead to PowerPoint and RTF files exploiting CVE-2014-4114, CVE-2015-1641 and CVE-2012-0158.	SecurityWeek (Symantec research)
2015-12 to 2016-07	Government agencies, armed forces and embassies in South Asia; Chinese nationals	MONSOON: more than 172 topical lure documents (most often a fake 2016 China military power report), about 6,300 victim IP addresses in more than 110 countries, 61 percent in China. Malware included BADNEWS, TINYTYPHON, Unknown Logger and an AutoIt backdoor.	Forcepoint
2015-11 to 2016-07	Diplomatic and economic organizations dealing with China’s foreign relations	Two-stage spear-phishing (a ping document, then Word or PowerPoint exploits for CVE-2012-0158 and CVE-2014-6352) plus a site republishing real news articles that required a malicious PowerPoint download to read them in full, T1189 (Drive-by Compromise). An AutoIt backdoor stole Chrome credentials and a file stealer took Office and PDF documents.	Kaspersky
2013-05	Telenor (Norway); national-security targets in Pakistan; firms in the US and elsewhere	Norman exposes Operation Hangover after a spear-phishing intrusion at Telenor, saying the operation dates to at least September 2010 and expressing confidence it was run by Indian attackers, with no direct evidence of state sponsorship. Forcepoint and MITRE later link Hangover to Patchwork.	PCWorld

Target vectors risk profile

Government	Defense	Diplomatic	Education/research	Espionage	Mobile/Android	Dissidents/NGOs	Energy	Telecom	Technology/SaaS	Media/journalists	Finance	Ransomware/extortion	Disruption/wiper
High	High	High	High	High	High	Medium	Medium	Medium	Medium	Medium	Low	N/A	N/A

Malware and tools

Name	What it does	Public detection	Reports
Unnamed in-memory RAT (VLC and Fondue.exe side-loading chains)	32-bit RAT decrypted from an encrypted file and run in memory; runs commands, transfers files, takes screenshots; the 2026 version adds heavy obfuscation and anti-VM checks	Indicators in the Arctic Wolf and Rapid7 reports	Arctic Wolf, Rapid7
StreamSpy, Spyder	Trojan using WebSocket for commands and HTTP for file transfer; related downloader that fetches password-protected ZIP payloads	Indicators in QiAnXin’s report	QiAnXin
Nexe backdoor	Shellcode-loaded stealer that patches AMSI and ETW and sends host details to its C2	Indicators in Cyble’s report	Cyble
PGoShell, Brute Ratel C4	Go backdoor with remote shell, screen capture and payload download; commercial red-team framework first seen with the group in 2024	Indicators in Knownsec’s report	Knownsec 404
EyeShell	Modular .NET backdoor for file operations and screenshots	Indicators in Knownsec’s report	Knownsec 404
VajraSpy	Android spyware in trojanized chat apps: contacts, SMS, call logs, location, files, WhatsApp and Signal messages	Indicators in ESET’s malware-ioc repository	ESET
BADNEWS (including the Ragnatela variant)	The group’s signature backdoor: keylogging, document theft, screenshots, download-and-execute, with C2 addresses hidden on RSS feeds, forums and GitHub	Community YARA rules in signature-base (MONSOON) and signature-base (Patchwork)	Unit 42, ThreatDown, MITRE ATT&CK
BackConfig	Plug-in backdoor with keylogging and payload download, persisted through scheduled tasks	Indicators in Unit 42’s report	Unit 42, MITRE ATT&CK
QuasarRAT	Open-source C# remote administration tool used against think-tank targets	Community YARA rules in signature-base	Volexity
AutoIt backdoor, TINYTYPHON, Unknown Logger	Early-era backdoor that stole Chrome credentials, a document stealer, and a freely available keylogger	Indicators in Forcepoint’s report	Kaspersky, Forcepoint

Reports

Date	Source	Report
2026-06-17	Rapid7	Malware à la mode: tracking Dropping Elephant tradecraft through a China-themed loader chain
2025-12-02	QiAnXin	Analysis of StreamSpy, a new trojan using WebSocket by Patchwork (APT-Q-36)
2025-07-23	Arctic Wolf	Dropping Elephant APT group targets Turkish defense industry with new campaign and capabilities
2024-09-26	Cyble	Nexe backdoor unleashed: Patchwork APT group’s sophisticated evasion of defenses
2024-07-18	Knownsec 404	The Patchwork group has updated its arsenal, launching attacks for the first time using Brute Ratel C4 and an enhanced version of PGoShell
2024-02-01	ESET	VajraSpy: a Patchwork of espionage apps
2023-07-26	Knownsec 404	PatchWork’s new assault weapons report: EyeShell weapons disclosure
2023-05-03	Meta	Meta’s Adversarial Threat Report, first quarter 2023
2022-01-07	ThreatDown (Malwarebytes)	Patchwork APT caught in its own web
2020-05-11	Unit 42	Updated BackConfig malware targeting government and military organizations in South Asia
2018-06-07	Volexity	Patchwork APT group targets US think tanks
2018-03-07	Unit 42	Patchwork continues to deliver BADNEWS to the Indian subcontinent
2017-12	Trend Micro	Untangling the Patchwork cyberespionage group
2016-08-08	Forcepoint	MONSOON: analysis of an APT campaign
2016-07-26	SecurityWeek (on Symantec research)	Patchwork threat actor expands target list
2016-07-08	Kaspersky	The Dropping Elephant: aggressive cyber-espionage in the Asian region
2013-05-20	PCWorld (on Norman research)	Attack on Telenor was part of large cyberespionage operation with Indian origins, report says
Ongoing	MITRE ATT&CK	Patchwork (G0040)

Vulnerabilities exploited

Vulnerability	CVSS	Severity	Publisher	Platform	CISA KEV
CVE-2017-11882	7.8	High	Microsoft	Office Equation Editor	Yes
CVE-2017-8570	7.8	High	Microsoft	Office (Composite Moniker)	Yes
CVE-2017-0261	7.8	High	Microsoft	Office (EPS file handling)	Yes
CVE-2017-0199	7.8	High	Microsoft	Office and WordPad (OLE / HTA handler)	Yes
CVE-2015-2545	7.8	High	Microsoft	Office (EPS file handling)	Yes
CVE-2015-1641	7.8	High	Microsoft	Word and Office (RTF memory corruption)	Yes
CVE-2014-6352	7.8	High	Microsoft	Windows OLE	Yes
CVE-2014-4114	9.3 (CVSS v2)	High	Microsoft	Windows OLE (“Sandworm”)	Yes
CVE-2012-1856	8.8	High	Microsoft	Office Common Controls (MSCOMCTL.OCX TabStrip)	Yes
CVE-2012-0158	8.8	High	Microsoft	Office Common Controls (MSCOMCTL.OCX)	Yes

If you’re in their sights

Do this now

Block or quarantine shortcut (.lnk) files arriving by email or inside ZIP archives, and teach staff that a “PDF” with a shortcut arrow is not a PDF. Almost every Patchwork chain since 2024 starts with one.
Patch Office and kill the legacy attack surface: remove the old Equation Editor, block macros from the internet, and make sure the 2012 to 2017 Office bugs listed here are long fixed. This group still gets mileage out of them.
Hunt for scheduled tasks that run every minute and launch a legitimate signed program (VLC, Fondue.exe, WerFaultSecure.exe, VMware tools) from C:\Users\Public, C:\Windows\Tasks or a temp folder next to an unexpected DLL. That is the group’s side-loading fingerprint.
Treat unsolicited conference invitations, think-tank articles and government notices as suspect, verify them with the sender by another channel, and block remote images in email so tracking pixels don’t confirm who opened a lure.
On phones, allow chat and messaging apps only from known publishers through mobile device management, and warn defense and government staff that a new online romantic contact asking them to install an app is a known VajraSpy lure.

Compiled from Rapid7, QiAnXin, Arctic Wolf, Cyble, Knownsec 404, ESET, Meta, ThreatDown (Malwarebytes), Unit 42, Volexity, Trend Micro, Forcepoint, Kaspersky, Symantec research via SecurityWeek, Norman research via PCWorld, The Hacker News and MITRE ATT&CK. Last reviewed November 1, 2026.