QUILTED_TIGER__2021__A_Deep_Dive_Into_Patchwork_APT_Group_Cyble.pdf

This Cyble report analyzes a Patchwork (Dropping Elephant) APT campaign that delivered a malformed Word document exploiting CVE-2019-0808 to deploy a custom RAT/keylogger (MSBuild.exe). The analysis includes sample hashes, C2 IPs, mutex and file paths, data collection/exfiltration behavior, persistence mechanisms (startup folder and Image File Execution Options), MITRE ATT&CK mappings, and defensive recommendations.