CVE Intelligence
Início / Grupos de ameaça / Patchwork

Patchwork G0040

🔔 Criar alerta

Também conhecido como: Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

6
CVEs associadas
49
Técnicas
8
Malwares e ferramentas

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2017-8570 Alta · 7.8 KEV Microsoft Office Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2015-1641 Alta · 7.8 KEV Microsoft Office Memory Corruption Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2014-4114 Alta · 7.8 KEV Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”
CVE-2012-1856 Alta · 8.8 KEV Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
“The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.”

Técnicas por tática

Reconhecimento
T1598.003 Spearphishing Link
Desenvolvimento de recursos
T1587.002 Code Signing CertificatesT1588.002 Tool
Acesso inicial
T1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execução
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1197 BITS JobsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data ExchangeT1574.001 DLL
Persistência
T1053.005 Scheduled TaskT1112 Modify RegistryT1197 BITS JobsT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1053.005 Scheduled TaskT1055.012 Process HollowingT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Furtividade
T1027.001 Binary PaddingT1027.002 Software PackingT1027.005 Indicator Removal from ToolsT1027.010 Command ObfuscationT1036.005 Match Legitimate Resource Name or LocationT1055.012 Process HollowingT1070.004 File DeletionT1197 BITS JobsT1574.001 DLL
Comprometimento de defesas
T1112 Modify RegistryT1553.002 Code Signing
Acesso a credenciais
T1555.003 Credentials from Web Browsers
Descoberta
T1033 System Owner/User DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1518.001 Security Software DiscoveryT1680 Local Storage Discovery
Movimento lateral
T1021.001 Remote Desktop Protocol
Coleta
T1005 Data from Local SystemT1074.001 Local Data StagingT1119 Automated CollectionT1560 Archive Collected Data
Comando e controle
T1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1132.001 Standard Encoding

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.