Patchwork is an Indian threat actor that has been active since December 2015 and usually targets Pakistan via spear phishing attacks. Patchwork has used malicious RTF files to drop a variant of the BADNEWS (Ragnatela) RAT in recent campaign targeting medical researchers
Ragnatela
A new variant of the BADNEWS RAT called Ragnatela being distributed via spear phishing emails to targets of interest in Pakistan. Ragnatela, which means spider web in Italian, is also the project name and panel used by Patchwork APT.
Ragnatela RAT features with the following capabilities:
- Executing commands via cmd
- Capturing screenshots
- Logging Keystrokes
- Collecting list of all the files in victim’s machine
- Collecting list of the running applications in the victim’s machine at a specific time periods
- Downing addition payloads
- Uploading files
Patchwork lures them with documents impersonating Pakistani authorities for distribution. For example, a document called EOIForm.rtf was uploaded by the threat actor onto their own server at karachidha[.]org/docs/. The file contains an exploit which is meant to compromise the victim’s computer and execute the final payload (RAT).That payload is stored within the RTF document as an OLE object.
Ragnatela RAT communicates with the attacker’s infrastructure via a server located at bgre.kozow[.]com. Prior to launching this campaign, the threat actor tested that their server was up and running properly.
Victims
- Ministry of Defense- Government of Pakistan
- National Defense University of Islam Abad
- Faculty of Bio-Science, UVAS University, Lahore, Pakistan
- International center for chemical and biological sciences
- HEJ Research institute of chemistry, International center for chemical and biological sciences, univeristy of Karachi
- SHU University, Molecular medicine
Indicators of Compromise
Lure
karachidha[.]org/docs/EOIForm.rtf
5b5b1608e6736c7759b1ecf61e756794cf9ef3bb4752c315527bcc675480b6c6
RAT
jli.dll
3d3598d32a75fd80c9ba965f000639024e4ea1363188f44c5d3d6d6718aaa1a3
C2
bgre[.]kozow[.]com
