QUILTED TIGERThreat actor
- apt-c-09
- atk11
- chinastrats
- Dropping Elephant
- g0040
- hangover group
- monsoon
- orange athos
- patchwork
- sarit
- thirsty gemini
- zinc emerson
Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools. Its victims are all involved with China’s foreign relations in some way, and are generally caught through spear-phishing or watering hole attacks.From MISP Galaxy
Last reported 12 days ago, by The Hacker News2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1053.005Scheduled Task
“This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server.”
- T1110.004Credential Stuffing
“…omino's Pizza cred-stuffing attack: Domino's Pizza is contacting users and urging them to change their password after suffering a credential-stuffing attack that compromised their accounts this month.”
- T1552.004Private Keys
“GoBalance bug exposes onion private keys: A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“The India-nexus adversary known as Dropping Elephant (aka Patchwork) has been observed targeting government, defense, naval, aerospace/UAV, academic, and other strategically significant sectors across Pakistan, Sri Lanka, China, and South Korea.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“Dropping Elephant: Indian-linked APT Dropping Elephant (Patchwork, APT-C-09) has been going after organizations in the government, defense, and naval sectors across Southeast Asia.”
Indicators in its reports
named in the reports above- fbijobs[.]govin 1 report
Copy this indicator · defanged
Thanks — we review every report.