Patchwork

Patchwork is a long-running cyber-espionage threat actor widely associated with Indian state interests and tracked under aliases including Dropping Elephant, Monsoon, Operation Hangover, Quilted Tiger, APT-C-09, ChinaStrats, Patchwork APT, and Zinc Emerson. Reporting has also linked the broader Operation Hangover and Monsoon activity clusters to Indian surveillance and espionage efforts, and some research has noted overlaps between Patchwork and other India-linked operators. Patchwork has historically focused on intelligence collection against regional strategic targets, including government, military, diplomatic, and other entities of geopolitical interest in South Asia and neighboring regions. Pakistan has repeatedly appeared as a primary target set, and the group has also been linked to operations involving Chinese interests and other regional adversaries. The actor is known for spearphishing-led intrusions that rely heavily on social engineering and user execution. Common delivery mechanisms include malicious Microsoft Office documents with embedded macros, lure documents themed to current political, military, or regional issues, and more recently malicious shortcut files used to launch PowerShell-based downloaders. Patchwork has demonstrated continued refinement of its tooling, including staged loaders, in-memory payload execution, DLL side-loading, and remote access trojans delivered through decoy content. In at least one documented campaign tracked as Dropping Elephant, the group used a themed lure to deploy a heavily reworked memory-resident RAT via PowerShell staging, abuse of a legitimate Microsoft binary for side-loading, scheduled-task persistence, dynamic API resolution, anti-analysis checks, and encrypted command-and-control traffic. Patchwork malware commonly performs broad host reconnaissance after compromise. Observed behaviors include collecting the victim computer name, username, administrative context, operating system version, processor architecture, and available drives; enumerating files and directories; and identifying installed security software. The group has searched local drives for documents matching targeted extensions, developed file-stealing components to harvest files of interest, and uploaded collected data to command-and-control infrastructure. It has also checked for the presence of defensive products before proceeding with follow-on activity. For persistence, Patchwork has used Windows startup mechanisms such as Startup folder placement and Registry Run keys. Additional observed tradecraft includes modification or deletion of Microsoft Office resiliency-related registry data, likely to reduce visible signs of document crashes or execution issues and improve social-engineering effectiveness. The group has also used Base64-encoded command-and-control traffic in some operations. Patchwork has expanded beyond Windows espionage tooling into mobile surveillance. The actor has been attributed with high confidence to Android campaigns involving trojanized applications carrying the VajraSpy malware family. These apps, often disguised as messaging or news applications and in some cases distributed through official app stores, supported surveillance functions such as theft of contacts, SMS messages, call logs, files, location data, installed application lists, and notifications. More capable variants were able to intercept communications from popular messaging platforms, record calls and ambient audio, log keystrokes, and capture images. These Android operations were assessed as primarily targeting users in Pakistan and were reportedly supported by social-engineering approaches including honey-trap style lures. Patchwork remains notable for its persistence, regional focus, and iterative development of espionage tooling across desktop and mobile platforms. Its operations consistently emphasize credentialed or user-assisted initial access, host profiling, document theft, stealthy persistence, and modular surveillance capabilities aligned with strategic intelligence collection.