Threat Actor 🇮🇳 India

QUILTED TIGER

Also known as: Chinastrats · Patchwork · Monsoon · Sarit · Dropping Elephant · APT-C-09 · ZINC EMERSON · ATK11 · G0040 · Orange Athos · Thirsty Gemini

Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools. Its victims are all involved with China’s foreign relations in some way, and are generally caught through spear-phishing or watering hole attacks.

Indicators of Compromise 4

Domain tracker[.]js Filename tracker.js GitHub Repo ChocoPoC Package skytext

MITRE ATT&CK TTPs 125

OS Credential Dumping

Credential Access

Data from Local System

Remote Services

Lateral Movement

Remote Desktop Protocol

Lateral Movement

SMB/Windows Admin Shares

Lateral Movement

Distributed Component Object Model

Lateral Movement

Lateral Movement

Lateral Movement

Windows Remote Management

Lateral Movement

Lateral Movement

Direct Cloud VM Connections

Lateral Movement

Obfuscated Files or Information

Defense Evasion

Software Packing

Defense Evasion

Exfiltration Over Alternative Protocol

Process Injection

Defense Evasion

Defense Evasion

Application Layer Protocol

Command And Control

Command And Control

File Transfer Protocols

Command And Control

Command And Control

Command And Control

Defense Evasion

System Information Discovery

Command And Control

Non-Application Layer Protocol

Command And Control

Ingress Tool Transfer

Command And Control

Local Email Collection

Trust Modification

Defense Evasion

Source Articles

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

The article covers multiple cyber threats including the disruption of the NetNut residential proxy network, which leveraged compromised home devices to route malicious traffic. Threat actors are targeting researchers with fake proof-of-concept repositories delivering the ChocoPoC RAT, while the Scattered Spider group is linked to extortion attempts. New malware such as Ousaban and browser-based ransomware exploit social engineering and legitimate browser APIs, and AI-driven attacks are increasing in sophistication, including indirect prompt injection and fake phishing pages generated via AI.

hacker-news ·3w ago