QUILTED_TIGER__2022__Patchwork_Patchwork-APT-caught-in-its-own-web_MalwarebytesLabs.pdf

Malwarebytes Labs reports that the Patchwork APT deployed a new BADNEWS/Ragnatela RAT via malicious RTF spearphishes targeting Pakistani government and biological-research institutions; the RAT provides command execution, keylogging, screenshots, file listing/transfers and downloads additional payloads. The actor’s operational mistakes (self-infection) exposed screenshots, keystrokes, PDB/source-path artifacts and testing evidence; the report provides IoCs including the lure (karachidha.org/docs/EOIForm.rtf), RAT filename/hash (jii.dll / 3d3598d3...), and C2 bgre.kozow.com.