Patchwork

Summary

Cyberespionage group first observed in December 2015 (MITRE G0040) that MITRE says may be a pro-Indian or Indian entity, targeting diplomatic and government organisations; Arctic Wolf likewise describes it as suspected to be of Indian origin. It relies on spearphishing with malicious documents and links, exploiting Office vulnerabilities such as CVE-2017-0199 and CVE-2017-11882, and on tooling largely copied from online forums alongside custom malware such as BADNEWS. In March–April 2018 Volexity saw it spearphish US think tanks with lures mimicking CFR, CSIS and MERICS and per-recipient tracking links. ESET attributed with high confidence twelve trojanised Android messaging apps carrying the VajraSpy RAT (six on Google Play, April 2021–March 2023), mostly aimed at users in Pakistan. In July 2025 Arctic Wolf reported a Dropping Elephant campaign against Turkish defense contractors, including a precision-guided missile manufacturer, using conference-themed LNK lures and VLC DLL side-loading.

Attribution

Not definitively attributed

Hedged, circumstantial or press-only reporting; not established.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Circumstantial evidence: may be pro-Indian or Indian
• Volexity (Research, 2018-06-07)
  Describes an Indian APT group

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 12

Malware and tools 8

Exploited vulnerabilities 6

Highest CVSS first.

Infrastructure patterns

• Dead-drop resolvers: encrypted C2 locations in comments on legitimate websites (MITRE ATT&CK, 2026)
• C2 protocol that impersonates legitimate websites — as Dropping Elephant (Arctic Wolf, 2025)

Reporting and advisories 4

• Arctic Wolf
  Dropping Elephant APT Group Targets Turkish Defense Industry
• ESET
  VajraSpy: A Patchwork of espionage apps
• Volexity
  Patchwork APT Group Targets US Think Tanks
• MITRE ATT&CK
  Patchwork (G0040) group profile