Dropping Elephant APT: Patchwork’s Espionage Tactics and Toolset

Summary

Dropping Elephant, also known as Patchwork, is an espionage-focused APT group targeting government and defense organizations. The group relies on multi-stage attack chains involving malicious Windows shortcuts, obfuscated PowerShell, and trojanized Android applications. Its operations use advanced techniques such as DLL side-loading, memory-resident RATs, and layered obfuscation to maintain persistence and exfiltrate sensitive data.

Investigation

The report examines the evolution of Dropping Elephant’s tactics from 2015 through 2026, including a recent shift toward Windows side-loading through VLC and specialized Android surveillance tooling. It analyzes multiple malware delivery chains, including the Donut loader and AES-256-CBC encrypted payloads. The investigation also documents command-line obfuscation and process injection techniques used to evade security controls.

Mitigation

Organizations should deploy strong endpoint protection capable of detecting unauthorized PowerShell execution and DLL side-loading activity. Monitoring for suspicious scheduled tasks and file creation in writable directories such as C:UsersPublic is essential. Enforcing strict application control policies and mobile device management can also reduce exposure to trojanized Android applications.

Response

If Dropping Elephant activity is detected, affected Windows and Android endpoints should be isolated immediately to limit lateral movement and further data exfiltration. Responders should perform memory forensics to identify injected code and review scheduled tasks for persistence. A broader hunt should also cover suspicious LNK files, malicious DLLs, and unauthorized C2 connections.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to download a second-stage payload while minimizing the footprint of the download command. To evade detection by simple string filters searching for Invoke-WebRequest or iwr, the attacker uses string fragmentation: iw''r. Additionally, the attacker suppresses the progress bar to prevent UI artifacts that might alert a user. Once the payload is delivered and executed via a shortcut-based persistence mechanism, the attacker deletes the shortcut GRES3001.lnk to clean up traces of the entry point.

• Regression Test Script:

  # 1. Create a dummy file to simulate the shortcut being deleted
  $lnkPath = "$env:USERPROFILEDownloadsGRES3001.lnk"
  New-Item -Path $lnkPath -ItemType File -Force
  
  # 2. Execute the obfuscated command sequence designed to trigger the rule
  # This combines the fragmented IWR, the progress suppression, and the file deletion.
  powershell.exe -Command "$ProgressPreference = 'SilentlyContinue'; iw''r -Uri 'http://localhost/test.txt'; Remove-Item -LiteralPath "$env:USERPROFILEDownloadsGRES3001.lnk" -Force"

• Cleanup Commands:

  # Remove any artifacts created during simulation
  Remove-Item -Path "$env:USERPROFILEDownloadsGRES3001.lnk" -ErrorAction SilentlyContinue