Patchwork APT Group Targets US Think Tanks

Summary: In March and April 2018, Volexity attributed multiple spear phishing campaigns to Patchwork, an Indian APT group also known as Dropping Elephant, which pivoted to targeting US-based think tanks by mimicking the Council on Foreign Relations, CSIS, and MERICS. The emails carried links to RTF documents exploiting CVE-2017-8570 to drop QuasarRAT, and embedded tracking images that beaconed to mailcenter.support with a unique 32-byte identifier per recipient.
Key Takeaway: The group lifted real articles from CFR, CSIS, and MERICS and used lookalike domains such as fprii.net and mericcs.org, so a recipient's existing trust in those institutions was the delivery mechanism. The tracking pixels told the attackers which targets opened the mail and what operating system and email client they ran, before any payload was clicked.

Read the original at Volexity Blog ↗

Topics: Phishing & Social Engineering
Mentions: CVE-2017-8570
Related: CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 25, 2022
Top 20 Vulnerabilities Exploited by Cyber Attackers | Qualys Cyber Risks ·
US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026