- Category
- State · Attributed to a state or working for one.
- Origin
- India(high confidence)
- Sponsor
- India
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0040 · 41 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0050 · patchwork
IndiaWhat it is
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- QUILTED TIGER, VICEROY TIGER, Operation HangOver, Monsoon, Viceroy Tiger
- Microsoft
- Mint Tempest
- MITRE ATT&CK
- G0040
- NSHC
- SectorE02
- Qihoo 360
- APT-C-09, APT-C-35
- Secureworks
- TG-4410
- Thales
- ATK11
- Operations
- Operation HangOver
- Other names
- Donot Team, APTC35, ATK 11, Capricorn Organisation, Chinastrats, Donot, Dropping Elephant, HangOver, Hangover Group, Maha Grass, MONSOON, Neon, Orange Athos, Orange Berserker, Orange Kala, Origami Elephant, Patchwork, Dropping Elephant, Sarit, The Dropping Elephant, Thirsty Gemini, Zinc Emerson
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Chinese and Russian sources
- Qihoo 360India
Targets
- Countries
- Argentina, Austria, Bangladesh, Bhutan, Cambodia, Canada, China, France, Germany, India, Indonesia, Iran, Israel, Japan, Jordan, Kuwait, Myanmar, Nepal, Norway, Oman, Pakistan, Panama, Philippines, Poland, Romania, Russia, Singapore, South Korea, Sri Lanka, Taiwan, Thailand, Togo, Türkiye, United Arab Emirates, United Kingdom, United States
- Sectors
- Aviation, Defense, Diplomacy, Embassies, Energy, Finance, Financial, Government, Government, Administration, Hospitality, IT, Media, Military, NGOs, Pharmaceutical, Private sector, Security Service, Telecommunications, Think Tanks
Tools
The tools and malware families the sources tie to it.
- Androrat
- AutoIt backdoor
- BADNEWS
- Back Orifice
- Back Orifice 2000
- BackConfig
- China Chopper
- DroidJack
- EHDevel
- MobileOrder
- NDiskMonitor
- PowerSploit
- QuasarRAT
- TINYTYPHON
- Unknown Logger
- VajraSpy
- yty
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net