Patchwork
G00401 reportsAnalyst assessment — key judgments
- Signature techniques: T1588.006 (Vulnerabilities), T1684 (Social Engineering).
- Primary targeting: CN.
- Activity declining: 0 report(s) in last 30d vs 1 prior (-100%).
- Hunt coverage 100% of 2 observed techniques (0 gap(s)).
- Assessment confidence: medium (60).
Activity & trend
Movement — last 30 days
Vulnerabilities in this actor's reporting · 7
- CVE-2026-10520KEV1 rpt
- CVE-2026-35273KEV1 rpt
- CVE-2026-41940KEV1 rpt
- CVE-2026-50751KEV1 rpt
- CVE-2026-02651 rpt
- CVE-2026-105231 rpt
- CVE-2026-330321 rpt
Overview
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)
ATT&CK technique matrix
- T1588.006 · Vulnerabilitiesconf 601
- T1684 · Social Engineeringconf 601
Threat catalogue · engineering roadmap
Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.
Infrastructure
Relationships
Activity
| Title | Source | Severity | Collected |
|---|