Loading story…
Patchwork, also tracked as Dropping Elephant, has been linked to a cross-platform espionage campaign that used fake PDF lures on Windows and trojanized chat applications on Android to surveil victims across multiple sectors and regions. Reported targets included organizations in government, defense, energy, research, aviation, finance, and technology across Asia, Europe, Türkiye, and the United States, indicating a broad intelligence-collection effort rather than opportunistic cybercrime.
On Windows, the operation reportedly relied on a malicious .lnk file disguised as a PDF that launched PowerShell, opened a decoy document, created persistence through scheduled tasks, and deployed a remote access tool using DLL side-loading and in-memory payload decryption. On Android, the group used romance-themed social engineering to persuade victims to sideload fake messaging apps such as Wave Chat, enabling theft of chats, keystrokes, contacts, files, call data, audio, and camera feeds; reporting on the campaign also cited associated indicators of compromise including domains, URL paths, package names, and malware filenames.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The reporting states that Patchwork, also known as Dropping Elephant, has been active since at least 2015. This establishes the earliest explicit time anchor for the threat actor discussed in the campaign coverage.
The reporting disclosed indicators of compromise tied to the campaign, including delivery and command-and-control domains such as expouav[.]org, roseserve[.]org, chinagreenenergy[.]org, fich[.]buzz, and gcl-power[.]org, as well as the Android package com.yoho.talk. One staging URL under chinagreenenergy[.]org was identified as retrieving both the decoy PDF and additional campaign components.
On Android, Patchwork used romance-themed social engineering to persuade targets to install malicious chat applications outside official app stores, including an identified app named Wave Chat. The implant could steal chats, keystrokes, notifications, contacts, messages, files, call data, audio, and camera captures, and it could persist after reboot.
The Windows malware created scheduled tasks named GoogleErrorReport and NewErrorReport for persistence and abused files such as Fondue.exe, vlc.exe, APPWIZ.cpl, libvlc.dll, vlc.log, and editor.dat to side-load and decrypt payloads. The final remote access tool was loaded in memory inside trusted Windows processes and could collect system data, execute commands, capture screenshots, and exfiltrate selected files.
In the Windows intrusion chain, Patchwork used a malicious shortcut file named GRES3001.lnk disguised as a PDF themed around a China-related energy contract. Opening it launched PowerShell via conhost.exe, displayed a decoy PDF, and retrieved additional malicious components.
Picus Security identified a Patchwork espionage campaign targeting Windows PCs and Android devices with fake PDF lures and trojanized chat applications. The activity reportedly targeted government, defense, energy, research, aviation, financial, and technology organizations across Asia, Europe, Türkiye, and the United States.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcepicussecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Patchwork, also tracked as **Dropping Elephant**, was linked to a cyber-espionage campaign that used phishing lures and a malicious macro to fetch a `.lnk` file, which then launched PowerShell to install staged malware, establish persistence, and contact command-and-control infrastructure. Researchers said the malware masqueraded as **VLC media player**, side-loaded a fake `libvlc.dll`, and dropped a decoy PDF to distract victims while additional payloads were deployed. The activity was described as targeting entities tied to government, military, diplomacy, NGOs, research, journalism, and activism, with a geographic focus on Pakistan, China, and other South Asian interests. Later-stage payloads used **MSIL-based executables** and supported victim registration, system profiling, antivirus and software discovery, command execution through `cmd.exe`, file download and upload, in-memory code execution, screenshot capture, and data exfiltration. Persistence was maintained through a scheduled task named **`WindowsErrorReport`**, while stealth relied on layered obfuscation including **XOR**, **Base64**, **Protean**, and **Scourgify**, along with **TLS 1.2** communications and retry logic. The reporting also identified malicious URLs, suspected C2 domains and IP addresses, and multiple file hashes tied to the operation.
Aug 15, 2026
Patchwork, an advanced persistent threat group also known as Monsoon, Dropping Elephant, and Hangover Group, has launched a new espionage campaign characterized by the use of sophisticated malware delivery techniques. The campaign begins with the distribution of malicious Microsoft Office documents containing illicit macros, which, when executed, trigger PowerShell scripts on the victim's system. These scripts are designed to download a trojanized executable that masquerades as the VLC media player, furthering the deception. The malware then sideloads a fake DLL library, a technique that allows it to evade detection by security software and gain persistence on the infected machine. To further obfuscate its activities, the malware injects a decoy PDF file into the Public Documents folder, likely to distract users and security analysts. A scheduled task is established in Windows to ensure the malicious executable is triggered regularly, maintaining the attacker's foothold. The final Patchwork payload is then loaded, enabling the threat actors to conduct extensive espionage operations. Technical analysis revealed that the malware uses Scourgify encoding to exfiltrate command outputs, making detection and analysis more challenging. The malware is also capable of running commands that segment large files, allocate executable memory, and capture full-screen screenshots, providing attackers with comprehensive surveillance capabilities. The campaign demonstrates a high level of modularity, allowing Patchwork to adapt its tactics and payloads as needed. Security researchers have recommended that organizations implement robust endpoint protection solutions to defend against such modular and stealthy threats. The use of DLL sideloading and layered obfuscation techniques highlights Patchwork's ongoing evolution and sophistication in cyber-espionage. The campaign's reliance on PowerShell-based loaders and scheduled tasks underscores the importance of monitoring script execution and task creation within enterprise environments. The attack chain leverages both social engineering, through malicious documents, and technical stealth, through obfuscation and sideloading. Patchwork's activities in this campaign are consistent with its historical focus on espionage against government and strategic targets. The campaign's discovery was attributed to detailed analysis by K7 Security Labs, which provided insights into the malware's operation and recommended defensive measures. Organizations are urged to educate users about the risks of enabling macros in Office documents and to monitor for unusual scheduled tasks and PowerShell activity. The campaign serves as a reminder of the persistent and evolving nature of APT threats targeting sensitive information.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026