Loading story…
Patchwork, also tracked as Dropping Elephant, was linked to a cyber-espionage campaign that used phishing lures and a malicious macro to fetch a .lnk file, which then launched PowerShell to install staged malware, establish persistence, and contact command-and-control infrastructure. Researchers said the malware masqueraded as VLC media player, side-loaded a fake libvlc.dll, and dropped a decoy PDF to distract victims while additional payloads were deployed. The activity was described as targeting entities tied to government, military, diplomacy, NGOs, research, journalism, and activism, with a geographic focus on Pakistan, China, and other South Asian interests.
Later-stage payloads used MSIL-based executables and supported victim registration, system profiling, antivirus and software discovery, command execution through cmd.exe, file download and upload, in-memory code execution, screenshot capture, and data exfiltration. Persistence was maintained through a scheduled task named WindowsErrorReport, while stealth relied on layered obfuscation including XOR, Base64, Protean, and Scourgify, along with TLS 1.2 communications and retry logic. The reporting also identified malicious URLs, suspected C2 domains and IP addresses, and multiple file hashes tied to the operation.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Cyble Research and Intelligence Labs reported that it observed an ongoing Patchwork campaign on July 24, 2024, likely targeting Chinese entities via phishing-delivered LNK lures. The report detailed DLL sideloading through WerFaultSecure.exe, EdgeUpdate scheduled-task persistence, AMSI/ETW patching, and a final in-memory payload dubbed the Nexe backdoor communicating with iceandfire[.]xyz.
Both references state that Patchwork, also known as Dropping Elephant, has been active since at least 2015. The group is described as targeting political, military, diplomatic, and related organizations in South and Southeast Asia.
A LinkedIn post attributed the activity to Patchwork and described a phishing-led intrusion chain using a malicious LNK lure, PowerShell, EXE and DLL payload downloads, scheduled-task persistence via EdgeUpdate, DLL sideloading, process injection, collection, and exfiltration. It also listed suspected C2-related domains and associated IP addresses tied to the campaign.
K7 Labs documented a Patchwork infection chain in which a malicious macro downloads a LNK file that uses PowerShell to fetch staged payloads, establish persistence via a scheduled task named WindowsErrorReport, and connect to command-and-control infrastructure. The report also disclosed technical details on victim profiling, command execution, file transfer, in-memory execution, screenshot capture, and indicators of compromise including hashes and malicious URLs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
linkedin.com
Open sourcelabs.k7computing.com
Open sourcecyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Patchwork, an advanced persistent threat group also known as Monsoon, Dropping Elephant, and Hangover Group, has launched a new espionage campaign characterized by the use of sophisticated malware delivery techniques. The campaign begins with the distribution of malicious Microsoft Office documents containing illicit macros, which, when executed, trigger PowerShell scripts on the victim's system. These scripts are designed to download a trojanized executable that masquerades as the VLC media player, furthering the deception. The malware then sideloads a fake DLL library, a technique that allows it to evade detection by security software and gain persistence on the infected machine. To further obfuscate its activities, the malware injects a decoy PDF file into the Public Documents folder, likely to distract users and security analysts. A scheduled task is established in Windows to ensure the malicious executable is triggered regularly, maintaining the attacker's foothold. The final Patchwork payload is then loaded, enabling the threat actors to conduct extensive espionage operations. Technical analysis revealed that the malware uses Scourgify encoding to exfiltrate command outputs, making detection and analysis more challenging. The malware is also capable of running commands that segment large files, allocate executable memory, and capture full-screen screenshots, providing attackers with comprehensive surveillance capabilities. The campaign demonstrates a high level of modularity, allowing Patchwork to adapt its tactics and payloads as needed. Security researchers have recommended that organizations implement robust endpoint protection solutions to defend against such modular and stealthy threats. The use of DLL sideloading and layered obfuscation techniques highlights Patchwork's ongoing evolution and sophistication in cyber-espionage. The campaign's reliance on PowerShell-based loaders and scheduled tasks underscores the importance of monitoring script execution and task creation within enterprise environments. The attack chain leverages both social engineering, through malicious documents, and technical stealth, through obfuscation and sideloading. Patchwork's activities in this campaign are consistent with its historical focus on espionage against government and strategic targets. The campaign's discovery was attributed to detailed analysis by K7 Security Labs, which provided insights into the malware's operation and recommended defensive measures. Organizations are urged to educate users about the risks of enabling macros in Office documents and to monitor for unusual scheduled tasks and PowerShell activity. The campaign serves as a reminder of the persistent and evolving nature of APT threats targeting sensitive information.
Jun 29, 2026
Patchwork, also tracked as **Dropping Elephant**, has been linked to a cross-platform espionage campaign that used fake PDF lures on Windows and trojanized chat applications on Android to surveil victims across multiple sectors and regions. Reported targets included organizations in government, defense, energy, research, aviation, finance, and technology across Asia, Europe, Türkiye, and the United States, indicating a broad intelligence-collection effort rather than opportunistic cybercrime. On Windows, the operation reportedly relied on a malicious `.lnk` file disguised as a PDF that launched PowerShell, opened a decoy document, created persistence through scheduled tasks, and deployed a remote access tool using DLL side-loading and in-memory payload decryption. On Android, the group used romance-themed social engineering to persuade victims to sideload fake messaging apps such as **Wave Chat**, enabling theft of chats, keystrokes, contacts, files, call data, audio, and camera feeds; reporting on the campaign also cited associated indicators of compromise including domains, URL paths, package names, and malware filenames.
Aug 7, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026