CVE Intelligence
Home / Threat actors / Patchwork

Patchwork G0040

🔔 Create alert

Also known as: Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

6
associated CVEs
49
Techniques
8
Malware and tools

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2017-8570 High · 7.8 KEV Microsoft Office Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2015-1641 High · 7.8 KEV Microsoft Office Memory Corruption Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2014-4114 High · 7.8 KEV Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2012-1856 High · 8.8 KEV Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”

Techniques by tactic

Reconnaissance
T1598.003 Spearphishing Link
Resource Development
T1587.002 Code Signing CertificatesT1588.002 Tool
Initial Access
T1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1197 BITS JobsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data ExchangeT1574.001 DLL
Persistence
T1053.005 Scheduled TaskT1112 Modify RegistryT1197 BITS JobsT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1055.012 Process HollowingT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Stealth
T1027.001 Binary PaddingT1027.002 Software PackingT1027.005 Indicator Removal from ToolsT1027.010 Command ObfuscationT1036.005 Match Legitimate Resource Name or LocationT1055.012 Process HollowingT1070.004 File DeletionT1197 BITS JobsT1574.001 DLL
Defense Impairment
T1112 Modify RegistryT1553.002 Code Signing
Credential Access
T1555.003 Credentials from Web Browsers
Discovery
T1033 System Owner/User DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1518.001 Security Software DiscoveryT1680 Local Storage Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol
Collection
T1005 Data from Local SystemT1074.001 Local Data StagingT1119 Automated CollectionT1560 Archive Collected Data
Command and Control
T1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1132.001 Standard Encoding

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.