QUILTED TIGER
ChinastratsPatchworkMonsoonSaritDropping ElephantAPT-C-09ZINC EMERSONATK11G0040Orange AthosThirsty GeminiHangover GroupOperation Hangover
Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools. Its victims are all involved with China’s foreign relations in some way, and are generally caught through spear-phishing or watering hole attacks. Source: MISP
Attributed country: IN according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 27 Oct 2026 · last seen on 27 Oct 2026
News
- So Many AI Security Benchmarks, But None Tell the Whole StoryDark Reading · 27 Oct 2026
MITRE ATT&CK techniques
Reconnaissance
Resource Development
Initial Access
T1189Drive-by Compromise 3 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rulesT1566.002Spearphishing Link 3 Sigma rules
Execution
T1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.003Windows Command Shell 40 Sigma rulesT1059.005Visual Basic 28 Sigma rulesT1197BITS Jobs 13 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rulesT1204.001Malicious Link 4 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1559.002Dynamic Data Exchange 1 Sigma rulesT1574.001DLL 40 Sigma rules
Persistence
Privilege Escalation
Credential Access
Discovery
T1033System Owner/User Discovery 26 Sigma rulesT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1518.001Security Software Discovery 5 Sigma rulesT1680Local Storage Discovery
Lateral Movement
Collection
T1005Data from Local System 12 Sigma rulesT1074.001Local Data Staging 4 Sigma rulesT1119Automated Collection 5 Sigma rulesT1560Archive Collected Data 11 Sigma rules
Command and Control
T1102.001Dead Drop Resolver 4 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1132.001Standard Encoding 4 Sigma rules
Stealth
T1027.001Binary Padding 2 Sigma rulesT1027.002Software PackingT1027.005Indicator Removal from Tools 4 Sigma rulesT1027.010Command Obfuscation 8 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1070.004File Deletion 9 Sigma rules
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗