Patchwork

Names and who uses them

• PatchworkOur name
• ChinastratsKaspersky
• Hangover GroupMITRE ATT&CK
• MONSOONMITRE ATT&CK
• Operation HangoverMITRE ATT&CK
• Dropping ElephantSymantec

Targets

Sectors: Government, Diplomatic

Known techniques

• T1005Data from Local System
• T1021.001Remote Desktop Protocol
• T1027.001Binary Padding
• T1027.002Software Packing
• T1027.005Indicator Removal from Tools
• T1027.010Command Obfuscation
• T1033System Owner/User Discovery
• T1036.005Match Legitimate Resource Name or Location
• T1053.005Scheduled Task
• T1055.012Process Hollowing
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1070.004File Deletion
• T1074.001Local Data Staging
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1102.001Dead Drop Resolver
• T1105Ingress Tool Transfer
• T1112Modify Registry
• T1119Automated Collection
• T1132.001Standard Encoding
• T1189Drive-by Compromise
• T1197BITS Jobs
• T1203Exploitation for Client Execution
• T1204.001Malicious Link
• T1204.002Malicious File
• T1518.001Security Software Discovery
• T1547.001Registry Run Keys / Startup Folder
• T1548.002Bypass User Account Control
• T1553.002Code Signing
• T1555.003Credentials from Web Browsers
• T1559.002Dynamic Data Exchange
• T1560Archive Collected Data
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1574.001DLL
• T1587.002Code Signing Certificates
• T1588.002Tool
• T1598.003Spearphishing Link

Malware and tools used