Listen to this Post
Introduction: A Silent Cyber-Espionage Campaign Continues to Grow
Cyber espionage is becoming more sophisticated with every passing year, and threat actors are constantly refining their techniques to stay ahead of security defenses. Among the most persistent espionage groups operating today is Patchwork, also known as Dropping Elephant, an Advanced Persistent Threat (APT) that has quietly expanded its operations for more than a decade. Rather than relying on noisy ransomware attacks or destructive malware, Patchwork focuses on stealth, intelligence gathering, and long-term infiltration of strategic organizations.
Its latest campaign demonstrates how modern cyber espionage has shifted toward memory-resident malware, deceptive phishing techniques, and advanced persistence mechanisms that leave very few traces behind. By combining fake PDF documents, Windows shortcut files, DLL side-loading, PowerShell abuse, and encrypted payloads, Patchwork continues to prove that sophisticated attackers no longer need zero-day exploits to compromise valuable targets.
Patchwork APT: A Long History of Cyber Espionage
Patchwork has remained active since at least December 2015, conducting carefully planned espionage campaigns against organizations considered strategically important.
Unlike financially motivated cybercriminals, this group focuses on collecting intelligence from high-value sectors that include:
Government agencies
Defense contractors
Energy companies
Aviation organizations
Financial institutions
Pharmaceutical companies
Research laboratories
Technology firms
NGOs
Think tanks
The campaign stretches across multiple continents, affecting organizations throughout Asia, Europe, Türkiye, and the United States.
Rather than conducting widespread attacks, Patchwork carefully selects its victims using targeted phishing operations designed to maximize success while minimizing exposure.
A Timeline of Continuous Evolution
Patchwork has consistently updated its attack infrastructure over the years.
2023 Campaign
The attackers targeted Chinese research organizations using carefully crafted phishing documents that ultimately deployed the EyeShell Backdoor.
2024 Campaign
The group shifted tactics by introducing malicious Windows shortcut (.LNK) files alongside the commercial red-team framework Brute Ratel C4, primarily targeting organizations connected to Bhutan.
2025 Campaign
The espionage operation expanded further toward Turkish defense contractors.
Victims received fake conference-related documents that secretly installed malware using:
VLC DLL Side-Loading
Encrypted payloads
Multi-stage malware loaders
2026 Campaign
The newest campaign revolves around China-themed energy contract documents that disguise malicious shortcut files as legitimate PDF reports.
Although the lure has changed, the objective remains exactly the same:
Steal intelligence while remaining completely hidden.
How the New Infection Chain Works
The latest Windows infection begins with a malicious .LNK shortcut disguised as a PDF document.
One observed sample, named GRES3001.lnk, appeared to contain information regarding a Chinese energy-sector contract completion.
To the victim, everything looks legitimate.
The shortcut even displays a realistic PDF icon inside Windows Explorer.
Once opened, however, the attack immediately begins.
Instead of opening a document, Windows launches:
conhost.exe
Hidden download commands
The victim eventually sees an authentic-looking PDF file, but only after malware has already begun downloading additional components in the background.
This deception significantly reduces suspicion.
PowerShell Obfuscation Helps Evade Detection
Patchwork avoids simple antivirus signatures by slightly modifying PowerShell commands.
Instead of using:
iwr
the attackers write:
iwr
Although both commands execute identically, many basic detection rules fail to recognize the modified syntax.
This tiny change highlights how even small obfuscation techniques can bypass poorly configured security solutions.
Persistence Through Scheduled Tasks
Once malware reaches the system, it immediately establishes persistence.
Patchwork creates scheduled tasks such as:
GoogleErrorReport
NewErrorReport
These scheduled tasks execute every minute, ensuring the malware automatically restarts if terminated.
The malware stores its files inside trusted Windows directories including:
C:UsersPublic
and
C:WindowsTasks
Finally, the original malicious shortcut is deleted to erase evidence of the initial compromise.
DLL Side-Loading Makes Detection More Difficult
Another hallmark of this campaign is DLL side-loading.
Instead of executing malware directly, Patchwork abuses legitimate Windows applications.
Researchers observed two primary techniques:
Fondue.exe Side-Loading
A legitimate executable loads a malicious:
APPWIZ.cpl
from the same directory.
VLC Media Player Side-Loading
A trusted VLC executable loads:
libvlc.dll
which has secretly been replaced with a malicious version.
Because security products often trust signed applications, malicious DLLs can execute with much lower suspicion.
Memory-Resident Malware Avoids Leaving Evidence
One of the
Encrypted shellcode is hidden inside seemingly harmless files including:
editor.dat
vlc.log
These files are decrypted only during execution.
The malware then uses the Donut loader to execute entirely in memory.
No final Remote Access Trojan (RAT) is written to disk.
Without an executable file for investigators to recover, traditional forensic investigations become significantly more difficult.
Security Features Are Disabled Before Surveillance Begins
Once loaded, the RAT attempts to weaken Windows security by modifying several defensive technologies.
Researchers observed attempts to patch:
AMSI (Antimalware Scan Interface)
Windows Lockdown Policy
Event Tracing for Windows (ETW)
Disabling or bypassing these mechanisms reduces malware visibility while limiting behavioral monitoring by endpoint security platforms.
Extensive Intelligence Collection
After successfully compromising a device, Patchwork begins gathering valuable information.
Collected intelligence includes:
Computer name
Username
Windows version
Running processes
Public IP address
Country information
Network configuration
The RAT also supports:
Remote command execution
File uploads
Screenshot capture
Process injection using QueueUserAPC
Additional payload deployment
These capabilities give operators long-term remote access while maintaining stealth.
Android Malware Expands the Espionage Campaign
Patchwork’s activities are not limited to Windows systems.
The group has also developed trojanized Android applications capable of harvesting sensitive information from mobile devices.
The mobile implants reportedly steal:
Messages
Files
Call history
Audio recordings
Images
Keystrokes
This cross-platform strategy significantly expands the intelligence available to attackers and demonstrates a mature operational capability.
Why Patchwork Continues to Be Dangerous
Patchwork does not rely on sophisticated zero-day exploits.
Instead, it combines well-known Windows features with careful social engineering and layered malware execution.
This makes the campaign both inexpensive and remarkably effective.
The continuous adaptation of phishing themes—including geopolitical events, defense conferences, research collaborations, and energy-sector contracts—shows that attackers closely monitor global developments to increase the likelihood of victim engagement.
Its strength lies not in revolutionary malware, but in disciplined operational security and consistent refinement.
Deep Analysis
The latest Patchwork campaign highlights a growing trend among modern APT groups: replacing traditional malware with memory-resident payloads that dramatically reduce forensic evidence. The combination of PowerShell obfuscation, DLL side-loading, encrypted shellcode, and scheduled task persistence represents a mature attack framework that balances stealth with operational reliability. Rather than deploying noisy malware, the attackers rely on trusted Windows components already present on the victim’s machine.
Security teams should prioritize behavioral detection over signature-based antivirus. Monitoring suspicious PowerShell activity, scheduled task creation, AMSI bypass attempts, and abnormal DLL loading is increasingly important.
Useful investigation and hunting commands include:
Get-ScheduledTask | Where-Object {$_.TaskName -match "GoogleErrorReport|NewErrorReport"}
schtasks /query /fo LIST /v
Get-Process
tasklist /m
netstat -ano
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
dir C:\Users\Public
dir C:\Windows\Tasks
Get-ChildItem -Recurse .lnk
Organizations should also enable PowerShell logging, AMSI integration, Windows Defender Attack Surface Reduction (ASR) rules, application allow-listing, and Endpoint Detection and Response (EDR) solutions capable of detecting memory injection and DLL side-loading behavior. Regular phishing-awareness training remains essential because the entire infection chain still begins with convincing social engineering.
What Undercode Say:
Patchwork is demonstrating an important reality about modern cyber espionage: attackers no longer need groundbreaking exploits to compromise high-value organizations. Instead, they combine trusted Windows features with carefully engineered deception, making detection far more difficult than prevention.
The shift toward memory-only execution is particularly concerning because it weakens traditional antivirus products that rely heavily on disk scanning. Security teams that continue depending solely on signature-based detection will likely miss sophisticated campaigns like this.
Another notable trend is the increasing use of legitimate applications for malicious purposes. DLL side-loading has become a favorite technique because trusted executables inherit a level of confidence from security products, allowing malicious code to execute with fewer alerts.
Patchwork also demonstrates excellent operational discipline. Every stage of the attack removes traces of the previous one—from deleting the original shortcut to encrypting payloads and operating primarily in memory. These techniques complicate incident response and extend attacker dwell time.
The
Defenders should recognize that phishing remains one of the weakest links in enterprise security. Even advanced technical defenses can be bypassed if users unknowingly execute a convincing shortcut disguised as a document.
Behavioral analytics, endpoint telemetry, PowerShell auditing, memory analysis, and continuous threat hunting are becoming mandatory rather than optional. Organizations should also validate trusted application behavior instead of assuming signed software is inherently safe.
Ultimately,
✅ Fact: Patchwork (Dropping Elephant) has been active since at least 2015 and is widely recognized as an espionage-focused Advanced Persistent Threat targeting government, defense, research, and strategic sectors.
✅ Fact: The campaign’s use of malicious Windows shortcut files, PowerShell execution, DLL side-loading, encrypted payloads, and memory-resident malware aligns with current threat intelligence describing the group’s evolving techniques.
✅ Fact: Capabilities such as AMSI bypass attempts, ETW interference, scheduled task persistence, remote command execution, screenshot capture, and information theft are consistent with modern espionage malware and reflect realistic post-compromise behavior observed in advanced APT operations.
Prediction
(+1) Security vendors will increasingly shift their detection capabilities toward behavioral analytics, memory inspection, and attack-chain correlation rather than relying primarily on file-based signatures. As espionage groups like Patchwork continue adopting fileless techniques, organizations that deploy advanced EDR, continuous threat hunting, AI-assisted detection, and stronger phishing resilience will significantly reduce the success rate of future campaigns, forcing threat actors to invest even more effort into bypassing modern defensive technologies.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
