Dropping Elephant (Patchwork): Espionage APT Tactics and Tools

**Dropping Elephant (Patchwork)** is an espionage-focused APT active since 2015 that targets government, defense, energy, research, and private-sector organizations across multiple regions using tailored phishing, malicious shortcuts, PowerShell stagers, DLL side‑loading, encrypted shellcode and memory-resident RATs, plus trojanized Android apps that capture messages, calls, keystrokes, images and files. The report catalogs the group's infrastructure, detailed MITRE ATT&CK-mapped TTPs, persistence and evasion techniques, data-exfiltration channels, and example indicators and timelines, and highlights simulation/testing guidance for defenders.