BADNEWS! Patchwork APT Hackers Score Own Goal in Recent Malware Attacks

Threat hunters have shed light on the tactics, techniques, and
procedures embraced by an Indian-origin hacking group called
Patchwork as part of a renewed campaign that commenced in late
November 2021, targeting Pakistani government entities and
individuals with a research focus on molecular medicine and
biological science.

“Ironically, all the information we gathered was possible thanks
to the threat actor infecting themselves with their own [remote
access trojan], resulting in captured keystrokes and screenshots of
their own computer and virtual machines,” Malwarebytes Threat
Intelligence Team said^[1]
in a report published on Friday.

Prominent victims that were successfully infiltrated include
Pakistan’s Ministry of Defense, National Defence University of
Islamabad, Faculty of Bio-Sciences at UVAS Lahore, International
Center for Chemical and Biological Sciences (ICCBS), H.E.J.
Research Institute of Chemistry, and the Salim Habib University
(SBU).

Believed to have been active since 2015, Patchwork APT^[2]
is also tracked^[3]
by the wider cybersecurity community under the monikers Dropping
Elephant, Chinastrats (Kaspersky), Quilted Tiger (CrowdStrike),
Monsoon (Forcepoint), Zinc Emerson, TG-4410 (SecureWorks), and
APT-C-09 (Qihoo 360).

The espionage group, primarily known for striking diplomatic and
government agencies in Pakistan, China, U.S. think tanks, and other
targets located in the Indian subcontinent via spear-phishing
campaigns, gets its name from the fact that most of the code used
for its malware tooling was copied and pasted from various sources
publicly available on the web.

“The code used by this threat actor is copy-pasted from various
online forums, in a way that reminds us of a patchwork quilt,”
researchers from the now-defunct Israeli cybersecurity startup
Cymmetria noted^[4]
in its findings published in July 2016.

Over the years, successive covert operations staged by the actor
have attempted to drop and execute QuasarRAT^[5]
as well as an implant named BADNEWS^[6]
that acts as a backdoor for the attackers, providing them with full
control over the victim machine. In January 2021, the threat group
was also observed^[7]
exploiting a remote code execution vulnerability in Microsoft
Office (CVE-2017-0261^[8]) to deliver payloads on
victim machines.

The latest campaign is no different in that the adversary lures
potential targets with RTF documents impersonating Pakistani
authorities that ultimately act as a conduit for deploying a new
variant of the BADNEWS trojan called Ragnatela — meaning “spider
web” in Italian — enabling the operators to execute arbitrary
commands, capture keystrokes and screenshots, list and upload
files, and download additional malware.

The new lures, which purport to be from the Pakistan Defence
Officers Housing Authority (DHA^[9]) in Karachi, contains an
exploit for Microsoft Equation Editor that’s triggered to
compromise the victim’s computer and execute the Ragnatela
payload.

But in what’s a case of OpSec failure, the threat actor also
ended up infecting their own development machine with the RAT, as
Malwarebytes was able to unmask a number of its tactics, including
the use of dual keyboard layouts (English and Indian) as well as
the adoption of virtual machines and VPNs such as VPN Secure and
CyberGhost to conceal their IP address.

“While they continue to use the same lures and RAT, the group
has shown interest in a new kind of target,” the researchers
concluded. “Indeed, this is the first time we have observed
Patchwork targeting molecular medicine and biological science
researchers.”