QUILTED_TIGER__2017__tech-brief-untangling-the-patchwork-cyberespionage-group.pdf

Patchwork (Dropping Elephant) is a persistent cyberespionage group targeting diplomatic, government, and business entities; this Trend Micro technical brief analyzes their 2017 campaigns, detailing spear-phishing and phishing infrastructure, weaponized documents (RTF/PPSX/DOCX exploiting multiple Office CVEs and DDE/SCT abuse), a range of payloads (xRAT, custom NDiskMonitor, Socksbot, Badnews) and bespoke file-stealers (Taskhost, Wintel, Autolt), plus C2/infrastructure techniques and IoCs to support detection and defense.