Clankerusecase
Threat-actor profile
 ← Back to main site
Home/ Threat Actors/ Patchwork

🇮🇳Patchwork

🇮🇳 Patchwork is a tracked threat actor in the Clankerusecase corpus. Attributed to IN. Primary motivation: State. We map 26 detection use cases to this actor across 63 MITRE ATT&CK techniques, with 4 threat-intel articles citing them. Active in our corpus from 2020-11-13 to 2026-08-06.

crit 1high 1med 2
View full actor card → All threat actors MITRE ATT&CK group spec (G0040) ↗
26Use cases
4Articles
63Techniques
4IOCs

Known aliases

PatchworkDropping ElephantChinastratsQuilted TigerHangover GroupMONSOONOperation Hangover

Top techniques

T1190 · Exploit Public-Facing ApplicationT1059.001 · PowerShellT1204.002 · Malicious File

All other tracked techniques

T1003 · OS Credential DumpingT1003.001 · LSASS MemoryT1005 · Data from Local SystemT1021.001 · Remote Desktop ProtocolT1021.002 · SMB/Windows Admin SharesT1027 · Obfuscated Files or InformationT1027.001 · Binary PaddingT1027.002 · Software PackingT1027.005 · Indicator Removal from ToolsT1027.010 · Command ObfuscationT1033 · System Owner/User DiscoveryT1036.005 · Match Legitimate Resource Name or LocationT1053.005 · Scheduled TaskT1055.012 · Process HollowingT1059.003 · Windows Command ShellT1059.005 · Visual BasicT1070.004 · File DeletionT1071 · Application Layer ProtocolT1071.001 · Web ProtocolsT1071.004 · DNST1074.001 · Local Data StagingT1078.004 · Cloud AccountsT1082 · System Information DiscoveryT1083 · File and Directory DiscoveryT1098.001 · Additional Cloud CredentialsT1102 · Web ServiceT1102.001 · Dead Drop ResolverT1105 · Ingress Tool TransferT1112 · Modify RegistryT1119 · Automated CollectionT1132.001 · Standard EncodingT1189 · Drive-by CompromiseT1195.002 · Compromise Software Supply ChainT1197 · BITS JobsT1203 · Exploitation for Client ExecutionT1204.001 · Malicious LinkT1204.004 · Malicious Copy and PasteT1218 · System Binary Proxy ExecutionT1219 · Remote Access ToolsT1486 · Data Encrypted for ImpactT1518.001 · Security Software DiscoveryT1539 · Steal Web Session CookieT1547.001 · Registry Run Keys / Startup FolderT1548.002 · Bypass User Account ControlT1550.001 · Application Access TokenT1553.002 · Code SigningT1555.003 · Credentials from Web BrowsersT1559.002 · Dynamic Data ExchangeT1560 · Archive Collected DataT1562.008 · T1562.008T1566 · PhishingT1566.001 · Spearphishing AttachmentT1566.002 · Spearphishing LinkT1569.002 · Service ExecutionT1574.001 · DLLT1574.002 · T1574.002T1587.002 · Code Signing CertificatesT1588.002 · ToolT1598.003 · Spearphishing LinkT1680 · Local Storage Discovery

Detection use cases (26)

Patchwork (Dropping Elephant) weaponized-Office exploit chain → mshta/certutil/PowerShell stager AI · profile SΣDD Patchwork BADNEWS dead-drop-resolver C2 from side-loaded / non-browser process AI · profile SDD Outbound traffic to known AI token-jacking transfer-station infrastructure (Unit42 IPs) Bespoke Transfer-station client fingerprint: Go-http-client/2.0,gzip(gfe) user-agent in web egress Bespoke AI resource key creation paired with logging/alert teardown in cloud control plane Bespoke Beaconing — periodic outbound to small set of destinations Internal Network connections to article IPs / domains Internal Infostealer — non-browser process accessing browser cookie/login DBs Internal Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal Trusted vendor binary / installer launching unusual children Internal Remote service execution — PsExec / SMB lateral movement Internal AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process MITRE match AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer package install spawning script-host with non-registry C2 within 5 minutes MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Internet-Facing Service Daemon Spawns Shell or Ingress Tool Then Beacons Out MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes MITRE match npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules MITRE match

Threat-intel articles (4)

high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources · 2026-08-06
med Cloud workload security: Mind the gaps · 2026-03-24
crit Naming and shaming: How ransomware groups tighten the screws on victims · 2026-02-12
med Python Poetry package manager and security integration with software composition analysis tool · 2020-11-13

Tracked indicators

IP addresses (4)

116.105.166.148 172.96.142.186 3.235.109.125 38.46.219.166