Threat Intelligence Tarot
swords · 11
India (suspected)
G0040★★★★★
risk 3/5
✦ The Collage ✦
Patchwork
Dropping Elephant · Chinastrats · Quilted Tiger · Monsoon
ChinaPakistanThink tanksUniversitiesClimate researchersDiplomats
Active since ~2009 · China surveillance, Pakistan intelligence, Climate and energy policy monitoring
It assembled itself from pieces - copy-pasted code, borrowed tools, recycled infrastructure. The Collage is less art than function: mismatched but operational, watching Chinese think tanks and Pakistani ministries with tools built from the internet's trash.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Researchers accidentally infected own systems with BADNEWS RAT (2018)
- ◆Chinese state and academic institutions targeting
- ◆Climate conference researcher surveillance
- ◆South Asian diplomatic community compromise
Defenses
- ▸Link filtering and browser isolation for email linksCIS Control 9 ↗
- ▸PowerShell logging and constrained language modeCIS Control 8 ↗
- ▸Think-tank and academic sector threat intelligence sharingNIST CSF: ID.RA ↗
- ▸Screen capture and clipboard monitoring capabilitiesNIST CSF: DE.CM ↗
Reversed: Their Weakness
Patchwork's most notable operational security failure was legendary: in 2018, researchers discovered the group had infected its own development machines with its own BADNEWS RAT, exposing operators' identities, their development environment, and their targeting lists.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.