Patchwork

ACTIVE CAMPAIGN TRACKED ▲ High Threat India

Primary Aliases: Mint Tempest Patchwork Tiger Quilted Tiger UNC2544

Sponsor / State Affiliation Indian Government

Primary Motivation Strategic espionage and geopolitical intelligence gathering

Active Timeline Unknown – Present

Confidence Rating 90% (Grounded)

Turkish Defense Espionage, Chinese University & Power Grid Campaign, PowerShell-based Loader Deployment

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Government Defense Contractors Academic Institutions Energy Think Tanks NGOs Aviation Financial Pharmaceutical

🛡️ MITRE ATT&CK® Attack Lifecycle (10 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spear-phishing

Execution 2

T1059 PowerShell-based loaders

T1059 Scheduled Tasks for persistence

Persistence & Privilege Escalation 1

T1547 DLL Side-loading (e.g., VLC media player spoofing)

Command & Control 1

T1071 Memory-resident RATs

Operational Techniques 5

T1000 Malicious LNK files

T1000 API Patching (AMSI and ETW bypass)

T1000 Rust-based loaders

T1000 C# Trojans (e.g., Protego)

T1000 Scourgify encoding

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Dropping Elephant Patchwork Espionage APT: Multi-Platform Tactics and Tooling

Attacks and Vulnerabilities 2026-08-06

Copied to clipboard

LINK COPIED TO CLIPBOARD