NDiskMonitor — Malware Profile

NDiskMonitor is a custom backdoor written in .NET that appears to be unique to Patchwork.

MITRE ATT&CK techniques (5)

• T1033 System Owner/User Discovery
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1573.001 Symmetric Cryptography

Attributed threat actors

• Patchwork

Read the full analysis on IntelFusions