Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · QUILTED TIGER · Nation-state · assessed origin India · misp-galaxy + mitre-attack · refreshed 2026-10-06

QUILTED TIGER

  • Chinastrats
  • Patchwork
  • Monsoon
  • Sarit
  • Dropping Elephant
  • APT-C-09
  • ZINC EMERSON
  • ATK11

state sponsor · IndiaMITRE G0040 ↗

QUILTED TIGER — ATT&CK roseQT

attack rose · 41 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE4 new CVEs: CVE-2012-0158, CVE-2014-1761, CVE-2015-1641, CVE-2017-0261

Analyst brief

misp-galaxy + mitre-attack

Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools. Its victims are all involved with China’s foreign relations in some way, and are generally caught through spear-phishing or watering hole attacks.

Observed targets (as stated by the sources)

3 countries · 4 sectors
BangladeshSri LankaPakistanAssessed origin: India

assessed origin · Indiaobserved targets · 3

countries · 3

  • Bangladesh
  • Sri Lanka
  • Pakistan

sectors · 4

  • Private sector
  • Military
  • Finance
  • Diplomacy

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

41 techniques · 13 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    2 techniques

  3. Initial access

    3 techniques

  4. Execution

    8 techniques

  5. Persistence

    1 technique

  6. Privilege escalation

    1 technique

  7. Stealth

    9 techniques

  8. Defense impairment

    2 techniques

  9. Credential access

    1 technique

  10. Discovery

    5 techniques

  11. Lateral movement

    1 technique

  12. Collection

    4 techniques

  13. Command and control

    3 techniques

select a technique

Arsenal

6 malware · 2 tools
Malware
Malware · 6ATT&CK
NDiskMonitorS0272 ↗
BackConfigS0475 ↗
TINYTYPHONS0131 ↗
AutoIt backdoorS0129 ↗
BADNEWSS0128 ↗
Unknown LoggerS0130 ↗
Tools
Tools · 2ATT&CK
QuasarRATS0262 ↗
PowerSploitS0194 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to QUILTED TIGER

none on KEV
  1. CVE-2017-02612026-10-17
    1. “One consistent campaign in July and August 2020 saw the threat actor use a vulnerability involving Encapsulated PostScript (EPS) images (CVE-2017-0261)”

      cited as used in a campaign · named nearby · source: pwc.co.uk ↗ · 2026-10-17

  2. CVE-2012-01582026-10-17
    1. “We have seen this dropped by an RTF exploiting CVE-2012-0158 under the name "DPP_INDIA_2016.doc"”

      cited as used in a campaign · named nearby · source: forcepoint.com ↗ · 2026-10-17

  3. CVE-2015-16412026-10-17
    1. “CVE-2015-1641 has been observed as being exploited to drop BADNEWS.”

      cited as used in a campaign · named nearby · source: forcepoint.com ↗ · 2026-10-17

  4. CVE-2014-17612026-10-17
    1. “Dropping Elephant artifacts are detected by Kaspersky Lab products as: Exploit.Win32.CVE-2012-0158.* Exploit.MSWord.CVE-2014-1761.*”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016Unveiling Patchwork the Copy Paste APTCymmetria ↗
  2. 2016The Dropping Elephant - aggressive cyber-espionage in the Asian regionKaspersky ↗
  3. 2016Patchwork cyberespionage group expands targets from governments to wide range of industriesSymantec ↗
  4. 2013Operation Hangover - Unveiling An Indian Cyberattack InfrastructureNorman, Shadowserver ↗
  5. 2013Operation Hangover |Executive SummaryNorman ↗
  6. 2013Operation Hangover - Unveiling An Indian Cyberattack Infrastructure (Appendix)Norman ↗

Take it with you

keyless · no signup

References

19 sources
  1. 1.community.broadcom.com/symantecenterprise/communities/community-home/libraryd…
  2. 2.forcepoint.com/blog/x-labs/monsoon-analysis-apt-campaign
  3. 3.cymmetria.com/patchwork-targeted-attack
  4. 4.s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf
  5. 5.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-t…
  6. 6.attack.mitre.org/groups/G0040
  7. 7.documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespion…
  8. 8.securelist.com/the-dropping-elephant-actor/75328
  9. 9.forcepoint.com/sites/default/files/resources/files/forcepoint-securit…
  10. 10.secureworks.com/research/threat-profiles/zinc-emerson
  11. +9 more in the JSON record

Track QUILTED TIGER on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.