摩诃草组织

This report documents the Mahorao (Patchwork/HangOver) APT group, detailing four campaigns from 2012–2016 that targeted China and other regions with spear-phishing, watering holes, instant messaging, social networks, and phishing sites, leveraging both known and zero-day CVEs and a diverse set of malware families (HangOver, OSX.Kumar, Smackdown, AutoIT RAT). It analyzes C2 infrastructure, attribution clues, and the broader threat landscape, arguing the attacker operates with substantial resources and state-backed backing and highlighting the need for capacity-based defense.