QUILTED TIGER — APT Profile

QUILTED TIGER is CrowdStrike's cryptonym for an India-nexus espionage group that other vendors track as Patchwork, Dropping Elephant, Monsoon, APT-C-09 and Chinastrats, and that MITRE ATT&CK catalogues as G0040. CrowdStrike describes its collection as aligned with Indian state intelligence priorities and concentrated on China and Pakistan, with secondary activity elsewhere in Asia and in North America; MITRE is more cautious, citing only circumstantial indications of an Indian or pro-India operator and dating the activity it attributes to the group to December 2015. Kaspersky's July 2016 analysis of the same cluster found diplomatic, government and economic victims selected for their links to Chinese foreign policy, reached through spear-phishing and through watering holes that served genuine news articles as bait. The tradecraft has stayed cheap rather than novel: Kaspersky recorded no zero-days, only ageing Office exploits such as CVE-2012-0158 and CVE-2014-6352 delivering AutoIt and PowerShell downloaders, and MITRE notes developers who reuse code lifted from public forums. Recurring implants include the BADNEWS backdoor, BackConfig and QuasarRAT, and MITRE also maps the Android spyware VajraSpy to the group, indicating the operation follows its targets onto mobile devices.

Tools & malware

Vendor research

Read the full analysis on IntelFusions