Patchwork
IntrusionSet · ATTACK:enterprise:G0040
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0040",
"title": "Patchwork",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0040",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--17862c7d-9e60-48a0-b48e-da4dc4c3f6b0",
"external_id": "G0040",
"domain": "enterprise",
"created": "2017-05-31T21:32:07.145Z",
"modified": "2026-07-31T20:48:25.895Z",
"version": "1.7",
"aliases": [
"Patchwork",
"Hangover Group",
"Dropping Elephant",
"Chinastrats",
"MONSOON",
"Operation Hangover"
],
"tactics": [
],
"source_references": [
{
"source_name": "Patchwork"
},
{
"source_name": "Chinastrats"
},
{
"source_name": "Dropping Elephant"
},
{
"source_name": "Hangover Group"
},
{
"source_name": "Cymmetria Patchwork",
"url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
},
{
"source_name": "Operation Hangover May 2013",
"url": "https://web.archive.org/web/20140424084220/http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf"
},
{
"source_name": "Symantec Patchwork",
"url": "http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries"
},
{
"source_name": "Unit 42 BackConfig May 2020",
"url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
},
{
"source_name": "Operation Hangover"
},
{
"source_name": "Securelist Dropping Elephant",
"url": "https://securelist.com/the-dropping-elephant-actor/75328/"
},
{
"source_name": "PaloAlto Patchwork Mar 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"
},
{
"source_name": "TrendMicro Patchwork Dec 2017",
"url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
},
{
"source_name": "Volexity Patchwork June 2018",
"url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
},
{
"source_name": "MONSOON"
},
{
"source_name": "Forcepoint Monsoon",
"url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
}
]
}Explicit source assertions (49)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01d1922c-6900-4ed3-8ddf-bae4d06296b3
TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03b18e87-f5f2-4d12-b5b3-2e1ba131b091
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e89ca75-b73e-476e-b56d-1cf815fa7868
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1576ad32-c7cc-45af-b39e-410d96a6f908
Unit 42 BackConfig May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--174698f8-9349-4e52-9887-18089038195c
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1770cc28-c49c-4b70-b4d0-6976efaede16
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1197
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19cc1620-de41-4076-b5b8-9d64364a578a
Unit 42 BackConfig May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a273c5c-b362-4126-b684-7751b85cbf5c
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0272
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ccf8b65-7f3e-4db7-933c-0a9bfae9602e
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1df7df54-c4c1-49f0-a0c3-11102db44f2c
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e666715-f087-44ad-aaa5-d22fbda42fba
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21caad94-1568-4e40-8e38-c0f7e854aede
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28139c5b-be96-44d2-8e54-425311d108d6
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2816f512-1a04-4cf8-94e9-36720b949c76
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f954be4-205c-4cec-92f9-36715e204a49
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40082714-cb19-482f-9b6d-22031ef39926
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42d4ae64-75da-4dfd-b23f-d270252115ee
Cymmetria Patchwork · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b63f8fd-efc7-454f-b466-d5e0a525f64f
Cymmetria Patchwork · Securelist Dropping Elephant · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c75f4e0-27ab-45d0-b8bc-3991137bdb87
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d26097f-2d6a-4642-857b-109c0f600a73
TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5eba2b01-da0d-4340-816b-16a4f3cc8ba6
Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62fd473e-e045-4a47-828a-ab5ee7b4fcf0
Symantec Patchwork · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67154159-cd44-4d9c-ae84-c82a8cd5ee58
Symantec Patchwork · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018 · Unit 42 BackConfig May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a5bc2dd-2132-4af0-9b12-0e781971d96c
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74316a28-d1a6-40b8-8c49-836f06e90e02
Cymmetria Patchwork · Symantec Patchwork · Unit 42 BackConfig May 2020 · Securelist Dropping Elephant · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--891a97f1-d3e2-45ff-a079-43dcad21a175
Securelist Dropping ElephantATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0475
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b2625de-8de9-4216-8805-d1e75093b098
Unit 42 BackConfig May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bb44b86-379d-49ba-9b28-2451e69db30d
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e28cc53-3fd4-42ed-8516-71fd9ee57641
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9015a88f-9442-41cb-8486-046b76cddc5d
TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9319fb2f-88df-4195-a42e-2a6a983a4840
Unit 42 BackConfig May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0131
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a35b72d-f238-4214-8bd1-91b768ab277b
Forcepoint MonsoonATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a58cbb63-024b-4b78-8dad-4661ee445212
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0a0e3c7-e1b2-4b84-8e37-8989147785d0
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3a9c32f-c6d0-46d4-8936-dd4fec61d305
Securelist Dropping ElephantATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdbd15f2-3c02-4f3a-b824-60f7f815c9c3
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5da001c-2c17-4e83-8e5c-21863ead4bd9
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6a4b8e6-eaf7-4b56-af0a-ba0fd070e97b
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0cd5f13-7e44-4728-98df-6e832f5d54dc
Forcepoint MonsoonATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d16d59aa-f056-4cc7-9f67-0e80db9cdacb
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6e43621-ca4a-475f-b81c-037a0878728b
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9b4a18a-955a-4ef8-93b2-61db23e59b75
Volexity Patchwork June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da734f6c-de0d-44f1-9521-6607b800ad43
Securelist Dropping Elephant · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e35a6a79-0ffc-4835-aaf8-e42dd20a7e45
Symantec Patchwork · Unit 42 BackConfig May 2020 · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8068ad2-97b3-4693-a6ad-a8ee9a272890
Cymmetria Patchwork · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0194
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f07267d5-f532-4a52-abd6-20d5f94a2bf8
Cymmetria PatchworkATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0128
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1456e13-5f3f-4dac-a002-2bd78c36348a
Forcepoint Monsoon · TrendMicro Patchwork Dec 2017ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0130
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f367b2fc-ea76-4fd4-9b90-049d95b4bc08
Forcepoint MonsoonATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7a4bc28-8f50-4e9e-9986-b71f21528967
TrendMicro Patchwork Dec 2017