Unveiling Patchwork

Patchwork is a high-sophistication targeted operation that leveraged deception to capture the attacker’s second-stage tooling and lateral movement, beginning with spear-phishing PPS attachments and a CVE-2014-4114 exploit, followed by AutoIt-based payloads, Meterpreter, data exfiltration, and a second-stage payload, with extensive IoCs and timeline analyses suggesting possible pro-Indian attribution.