AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0040 · 40 ATT&CK techniques · 0 correlated reports

Patchwork

Aliases: Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.

Open interactive actor investigation

ATT&CK techniques

T1059.005
Visual Basic T1560
Archive Collected Data T1083
File and Directory Discovery T1553.002
Code Signing T1574.002
DLL Side-Loading T1112
Modify Registry T1197
BITS Jobs T1027.005
Indicator Removal from Tools T1555.003
Credentials from Web Browsers T1053.005
Scheduled Task T1132.001
Standard Encoding T1055.012
Process Hollowing T1021.001
Remote Desktop Protocol T1547.001
Registry Run Keys / Startup Folder T1074.001
Local Data Staging T1036.005
Match Legitimate Name or Location T1566.001
Spearphishing Attachment T1027.010
Command Obfuscation T1588.002
Tool T1189
Drive-by Compromise T1204.001
Malicious Link T1518.001
Security Software Discovery T1203
Exploitation for Client Execution T1027.002
Software Packing T1033
System Owner/User Discovery T1005
Data from Local System T1204.002
Malicious File T1587.002
Code Signing Certificates T1070.004
File Deletion T1119
Automated Collection T1102.001
Dead Drop Resolver T1059.003
Windows Command Shell T1027.001
Binary Padding T1548.002
Bypass User Account Control T1059.001
PowerShell T1598.003
Spearphishing Link T1105
Ingress Tool Transfer T1566.002
Spearphishing Link T1082
System Information Discovery T1559.002
Dynamic Data Exchange

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research