Trusted Design

Patchwork

アクターID: G0040

· MITRE Pageへのリンク

脅威アクターの詳細

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)

脅威アクターの別名・別称

Patchwork
Hangover Group
Dropping Elephant
Chinastrats
MONSOON
Operation Hangover

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1557 - Adversary-in-the-Middle
• T1161 - LC_LOAD_DYLIB Addition
• T1568.002 - Domain Generation Algorithms
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1206 - Sudo Caching
• T1087.002 - Domain Account
• T1543.003 - Windows Service
• T1566.002 - Spearphishing Link
• T1598.003 - Spearphishing Link
• T1089 - Disabling Security Tools
• T1487 - Disk Structure Wipe
• T1103 - AppInit DLLs
• T1530 - Data from Cloud Storage
• T1120 - Peripheral Device Discovery
• T1584.003 - Virtual Private Server
• T1550 - Use Alternate Authentication Material
• T1059.009 - Cloud API
• T1562.012 - Disable or Modify Linux Audit System
• T1580 - Cloud Infrastructure Discovery
• T1219.001 - IDE Tunneling
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1059.004 - Unix Shell
• T1001 - Data Obfuscation
• T1218.010 - Regsvr32
• T1001.003 - Protocol or Service Impersonation
• T1506 - Web Session Cookie
• T1591.004 - Identify Roles
• T1601.001 - Patch System Image
• T1070.009 - Clear Persistence
• T1059.012 - Hypervisor CLI
• T1537 - Transfer Data to Cloud Account
• T1027.010 - Command Obfuscation
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1027.018 - Invisible Unicode
• T1665 - Hide Infrastructure
• T1008 - Fallback Channels

関連するCVE (攻撃手法に関連)

• CVE-2013-6282 (T1219.001)
• CVE-2015-2546 (T1027.018)
• CVE-2014-4113 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2017-0263 (T1027.018)
• CVE-2015-0057 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2008-1436 (T1219.001)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2017-0001 (T1027.018)
• CVE-2014-4114 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2014-1761 (T1218.010)
• CVE-2015-1641 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2013-3906 (T1601.001)
• CVE-2014-6352 (T1027.010)
• CVE-2010-3333 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2015-0016 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2011-0611 (T1591.004)
• CVE-2015-0071 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2015-1427 (T1566.002)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1219.001)
• CVE-2015-7645 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3456 (T1562.012)
• CVE-2015-3090 (T1027.018)
• CVE-2010-1553 (T1027.018)
• CVE-2015-3113 (T1218.010)
• CVE-2015-2590 (T1027.018)
• CVE-2015-5477 (T1566.002)
• CVE-2015-4495 (T1059.012)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1665)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7808 (T1218.010)
• CVE-2012-1889 (T1566.002)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1001)
• CVE-2016-1010 (T1027.018)
• CVE-2016-1019 (T1219.001)
• CVE-2016-0984 (T1027.018)
• CVE-2016-1001 (T1218.010)
• CVE-2016-0998 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-5749 (T1566.002)
• CVE-2015-3628 (T1218.010)
• CVE-2015-6034 (T1562.012)
• CVE-2015-2852 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2015-2853 (T1027.018)
• CVE-2015-7755 (T1218.010)
• CVE-2012-4969 (T1027.018)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2016-1287 (T1566.002)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2015-6022 (T1027.018)
• CVE-2015-7262 (T1001)
• CVE-2015-8286 (T1566.002)
• CVE-2015-8287 (T1218.010)
• CVE-2016-1562 (T1001)
• CVE-2016-2342 (T1566.002)
• CVE-2016-2343 (T1562.012)
• CVE-2016-6532 (T1566.002)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2017-3212 (T1566.002)
• CVE-2025-55182 (T1027.018)
• CVE-2025-61882 (T1566.002)
• CVE-2015-0311 (T1027.018)
• CVE-2015-0932 (T1001)
• CVE-2012-0056 (T1562.012)
• CVE-2010-3081 (T1219.001)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2012-1258 (T1219.001)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-3153 (T1218.010)
• CVE-2014-7911 (T1566.002)
• CVE-2014-4322 (T1219.001)
• CVE-2015-3636 (T1001)
• CVE-2015-3105 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2014-8361 (T1218.010)
• CVE-2017-16929 (T1027.018)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2014-8439 (T1219.001)
• CVE-2013-2551 (T1027.018)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2012-4681 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2015-5560 (T1219.001)
• CVE-2014-9163 (T1218.010)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2010-1297 (T1027.018)
• CVE-2013-7331 (T1219.001)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2010-2883 (T1591.004)
• CVE-2013-0634 (T1566.002)
• CVE-2014-7247 (T1027.018)
• CVE-2012-5054 (T1566.002)
• CVE-2013-2678 (T1027.018)
• CVE-2010-0738 (T1566.002)
• CVE-2015-2426 (T1027.018)
• CVE-2013-0641 (T1591.004)
• CVE-2014-3393 (T1001)
• CVE-2012-6422 (T1566.002)
• CVE-2013-2595 (T1059.009)
• CVE-2014-2273 (T1219.001)
• CVE-2015-4902 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2009-3129 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2013-5990 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2016-4117 (T1218.010)
• CVE-2017-7255 (T1566.002)
• CVE-2017-0143 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-13335 (T1001)
• CVE-2025-13927 (T1001)
• CVE-2025-13928 (T1001)
• CVE-2025-24893 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-54313 (T1566.002)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-68645 (T1027.018)
• CVE-2026-0723 (T1001)
• CVE-2026-1102 (T1001)
• CVE-2026-20127 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2025-66478 (T1219.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る