Dropping Elephant (Patchwork) Espionage APT Tactics and Tool...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://picussecurity.com/resource/blog/dropping-elephant-patchwork-espionage-apt-tactics-and-tools
• Blog Title: Dropping Elephant (Patchwork): Espionage APT Tactics and Tools
• Suggested Section: Windows Hardening → Windows Local Privilege Escalation → DLL Hijacking / Antivirus Bypass, with cross-references to Android Applications Pentesting → Accessibility Services Abuse and Reversing → Common API used in Malware

🎯 Content Summary

Overview and impact

Dropping Elephant, also known as Patchwork, is an espionage-focused APT first observed in December 2015. It targets government, defense, energy, research, aviation, financial, technology, pharmaceutical, NGO, and think-tank organizations across Asia, Europe, Türkiye, and the United States. The post does not describe exploitation of a CVE; compromise instead depends on tailored phishing, social engineering, malicious LNK files, sideloaded Android applications, Power...

🔧 Technical Details

Shortcut masquerading and split-token PowerShell: A Windows shortcut can use a document-like icon and filename while launching PowerShell through another process such as conhost.exe. Empty quotes can be inserted into PowerShell aliases and command names—such as iw''r, r''e''n, and g''cm sch*—because PowerShell reconstructs them during parsing. This preserves functionality while evading detections based on contiguous command strings. A stager can suppress progress output, retrieve a decoy and payloads, rename and copy components, create persistence, open the lure, and delete the original shortcut.

Scheduled-task DLL or CPL side-loading: Place a trusted executable and an attacker-controlled library with the expected filename or export in the same writable directory, then create a recurring scheduled task that launches the trusted executable. Windows library-search behavior causes the trusted ho...

🤖 Agent Actions

ERROR: Codex exec failed (exit=1).
2026-08-11T19:02:48.072036Z ERROR codex_core::session: Failed to create session: required MCP servers failed to initialize: chack_tools: handshaking with MCP server failed: connection closed: initialize response
Error: thread/start: thread/start failed: error creating thread: Fatal error: Failed to initialize session: required MCP servers failed to initialize: chack_tools: handshaking with MCP server failed: connection closed: initialize response (code -32603)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 988
• MD files fixed: 5

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://picussecurity.com/resource/blog/dropping-elephant-patchwork-espionage-apt-tactics-and-tools

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening → Windows Local Privilege Escalation → DLL Hijacking / Antivirus Bypass, with cross-references to Android Applications Pentesting → Accessibility Services Abuse and Reversing → Common API used in Malware".

Repository Maintenance:

• MD Files Formatting: 988 files processed (5 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0