Loading story…
Patchwork, an advanced persistent threat group also known as Monsoon, Dropping Elephant, and Hangover Group, has launched a new espionage campaign characterized by the use of sophisticated malware delivery techniques. The campaign begins with the distribution of malicious Microsoft Office documents containing illicit macros, which, when executed, trigger PowerShell scripts on the victim's system. These scripts are designed to download a trojanized executable that masquerades as the VLC media player, furthering the deception. The malware then sideloads a fake DLL library, a technique that allows it to evade detection by security software and gain persistence on the infected machine. To further obfuscate its activities, the malware injects a decoy PDF file into the Public Documents folder, likely to distract users and security analysts. A scheduled task is established in Windows to ensure the malicious executable is triggered regularly, maintaining the attacker's foothold. The final Patchwork payload is then loaded, enabling the threat actors to conduct extensive espionage operations. Technical analysis revealed that the malware uses Scourgify encoding to exfiltrate command outputs, making detection and analysis more challenging. The malware is also capable of running commands that segment large files, allocate executable memory, and capture full-screen screenshots, providing attackers with comprehensive surveillance capabilities. The campaign demonstrates a high level of modularity, allowing Patchwork to adapt its tactics and payloads as needed. Security researchers have recommended that organizations implement robust endpoint protection solutions to defend against such modular and stealthy threats. The use of DLL sideloading and layered obfuscation techniques highlights Patchwork's ongoing evolution and sophistication in cyber-espionage. The campaign's reliance on PowerShell-based loaders and scheduled tasks underscores the importance of monitoring script execution and task creation within enterprise environments. The attack chain leverages both social engineering, through malicious documents, and technical stealth, through obfuscation and sideloading. Patchwork's activities in this campaign are consistent with its historical focus on espionage against government and strategic targets. The campaign's discovery was attributed to detailed analysis by K7 Security Labs, which provided insights into the malware's operation and recommended defensive measures. Organizations are urged to educate users about the risks of enabling macros in Office documents and to monitor for unusual scheduled tasks and PowerShell activity. The campaign serves as a reminder of the persistent and evolving nature of APT threats targeting sensitive information.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed that the malware chain dropped a decoy PDF, sideloaded a fake DLL, and used Scourgify encoding to exfiltrate command output. Analysts also noted capabilities including file chunking, executable memory allocation, and full-screen screenshot capture and upload.
K7 Security Labs reported a new Patchwork APT espionage campaign using malicious Office documents with macros, a PowerShell-based loader, DLL sideloading, and Windows Scheduled Tasks to deploy the final payload. The campaign also used layered obfuscation and spoofed a VLC media player executable to evade detection.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Patchwork, also tracked as **Dropping Elephant**, was linked to a cyber-espionage campaign that used phishing lures and a malicious macro to fetch a `.lnk` file, which then launched PowerShell to install staged malware, establish persistence, and contact command-and-control infrastructure. Researchers said the malware masqueraded as **VLC media player**, side-loaded a fake `libvlc.dll`, and dropped a decoy PDF to distract victims while additional payloads were deployed. The activity was described as targeting entities tied to government, military, diplomacy, NGOs, research, journalism, and activism, with a geographic focus on Pakistan, China, and other South Asian interests. Later-stage payloads used **MSIL-based executables** and supported victim registration, system profiling, antivirus and software discovery, command execution through `cmd.exe`, file download and upload, in-memory code execution, screenshot capture, and data exfiltration. Persistence was maintained through a scheduled task named **`WindowsErrorReport`**, while stealth relied on layered obfuscation including **XOR**, **Base64**, **Protean**, and **Scourgify**, along with **TLS 1.2** communications and retry logic. The reporting also identified malicious URLs, suspected C2 domains and IP addresses, and multiple file hashes tied to the operation.
Aug 15, 2026
Patchwork, also tracked as **Dropping Elephant**, has been linked to a cross-platform espionage campaign that used fake PDF lures on Windows and trojanized chat applications on Android to surveil victims across multiple sectors and regions. Reported targets included organizations in government, defense, energy, research, aviation, finance, and technology across Asia, Europe, Türkiye, and the United States, indicating a broad intelligence-collection effort rather than opportunistic cybercrime. On Windows, the operation reportedly relied on a malicious `.lnk` file disguised as a PDF that launched PowerShell, opened a decoy document, created persistence through scheduled tasks, and deployed a remote access tool using DLL side-loading and in-memory payload decryption. On Android, the group used romance-themed social engineering to persuade victims to sideload fake messaging apps such as **Wave Chat**, enabling theft of chats, keystrokes, contacts, files, call data, audio, and camera feeds; reporting on the campaign also cited associated indicators of compromise including domains, URL paths, package names, and malware filenames.
Aug 7, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026