Unveiling Patchwork

Patchwork is a globally distributed, highly targeted operation against government and defense-related entities, first observed in 2015. The attackers employed spearphishing PPS attachments that exploited CVE-2014-4114 to drop an initial AutoIt-based payload, escalate with UAC bypass, and deploy Meterpreter-based modules; Cymmetria’s MazeRunner deception campaign captured the attacker’s second-stage tools and lateral movement. The report details infection flow, toolsets, C2 activity, IoCs, and discusses attribution—leaning toward a pro-Indian actor while acknowledging attribution remains inconclusive.