Patchwork

{
  "id": "ATTACK:mobile:G0040",
  "title": "Patchwork",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0040",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--17862c7d-9e60-48a0-b48e-da4dc4c3f6b0",
  "external_id": "G0040",
  "domain": "mobile",
  "created": "2017-05-31T21:32:07.145Z",
  "modified": "2026-07-31T20:48:25.895Z",
  "version": "1.7",
  "aliases": [
    "Patchwork",
    "Hangover Group",
    "Dropping Elephant",
    "Chinastrats",
    "MONSOON",
    "Operation Hangover"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Patchwork"
    },
    {
      "source_name": "Chinastrats"
    },
    {
      "source_name": "Dropping Elephant"
    },
    {
      "source_name": "Hangover Group"
    },
    {
      "source_name": "Cymmetria Patchwork",
      "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
    },
    {
      "source_name": "Operation Hangover May 2013",
      "url": "https://web.archive.org/web/20140424084220/http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf"
    },
    {
      "source_name": "Symantec Patchwork",
      "url": "http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries"
    },
    {
      "source_name": "Unit 42 BackConfig May 2020",
      "url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
    },
    {
      "source_name": "Operation Hangover"
    },
    {
      "source_name": "Securelist Dropping Elephant",
      "url": "https://securelist.com/the-dropping-elephant-actor/75328/"
    },
    {
      "source_name": "PaloAlto Patchwork Mar 2018",
      "url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"
    },
    {
      "source_name": "TrendMicro Patchwork Dec 2017",
      "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
    },
    {
      "source_name": "Volexity Patchwork June 2018",
      "url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
    },
    {
      "source_name": "MONSOON"
    },
    {
      "source_name": "Forcepoint Monsoon",
      "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
    }
  ]
}