Patchwork APT Group Targets US Think Tanks

Volexity observed Patchwork spear-phishing campaigns in Mar–Apr 2018 that impersonated US think tanks (CFR, CSIS, MERICS) and used tracking images to identify recipients; malicious RTF attachments exploited CVE-2017-8570 (public PoC) to drop QuasarRAT and other RATs, establish persistence via scheduled tasks, and beacon to identified C2 domains/IPs. The report provides exploitation details, sample files and hashes, network indicators, and analysis of the actors' tradecraft.