Patchwork

Patchwork, also known as Dropping Elephant, Monsoon, Operation Hangover, Quilted Tiger, APT-C-09, and Zinc Emerson, is an India-linked espionage threat actor active since at least 2015. The group is associated with cyber operations aligned with Indian national security interests and has been linked in reporting to broader Indian surveillance and hack-for-hire ecosystems. Patchwork has conducted long-running intelligence collection campaigns against regional adversaries and organizations of strategic interest. Patchwork is known for spearphishing and social-engineering operations that use decoy documents, malicious shortcut files, macro-enabled Office documents, and trojanized applications to gain initial access. Recent activity shows cross-platform targeting of both Windows and Android devices. On Windows, the actor has used disguised shortcut files to launch PowerShell downloaders, display lure documents, retrieve additional payloads, and deploy remote access tooling through DLL sideloading and in-memory execution. On Android, the group has used romance-themed lures and fake chat applications distributed outside official app stores to enable device surveillance. The actor’s tooling supports broad espionage collection. Observed capabilities include host profiling, user and privilege discovery, drive and file enumeration, targeted file theft, screenshot capture, command execution, and exfiltration of selected data. Android implants attributed to Patchwork have been observed stealing messages, contacts, notifications, and files; logging keystrokes; recording ambient audio and calls; and in some cases accessing the camera. Patchwork also employs persistence mechanisms including scheduled tasks, startup-folder placement, and Registry Run keys. Patchwork demonstrates consistent defense-evasion tradecraft. Reported behaviors include scanning for installed security software, deleting Microsoft Office resiliency artifacts, dynamic API resolution, anti-analysis checks, patching security telemetry interfaces, and hiding final payloads inside trusted processes. The group has also been associated with DLL sideloading using legitimate binaries and loaders that decrypt payloads locally before mapping them into memory. Targeting has included government, military and defense, energy, financial, research, aviation, and technology organizations across Asia, Europe, Türkiye, and the United States. Reporting also links Patchwork activity to operations against Chinese nationals and other regional adversaries. The actor’s dominant motivation is espionage.