Rewterz Threat Alert – PatchWork APT Group – Active IOCs

Severity

High

Analysis Summary

Patchwork is an Advanced Persistent Threat (APT) group that has been active since at least 2014. Patchwork primarily targets government, defense, and diplomatic organizations, as well as academic institutions, in South and Southeast Asia, including India, Pakistan, and Bangladesh. However, the group has also been known to target organizations in other regions, including Europe and North America.

The group is believed to be of Indian origin and has been linked to several cyber espionage campaigns. Patchwork has used a range of tactics, techniques, and procedures (TTPs) in its attacks. Once inside the networks, the group attempts to maintain persistence by regularly establishing new accounts, installing backdoors and other malicious tools, and performing malicious activities. Additionally, Patchwork has been known to employ social engineering techniques to track down and exfiltrate data from compromised systems. The group has also been known to use various evasion techniques in order to avoid detection by security solutions. In some cases, the group has been able to remain undetected for extended periods of time.

Overall, Patchwork is a sophisticated and persistent threat actor that poses a significant risk to targeted organizations. It is essential for organizations to have robust security measures in place to protect against these types of attacks, including regular software updates and employee awareness training.

Impact

• Information Theft
• Unauthorized Remote Access

Indicators of Compromise

MD5

• 117d2963a85ac6842bd4e6a082662fb1

SHA-256

• 67fee8b6bc173b98f2418b09e882883c648a11cfe6a21414187d944b7134f0f3

SHA-1

• b914a577a02baabcae60107ec42af9ade9a8b666

URL

http://en-us-office.herokuapp.com/updates/

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.