Patchwork APT Group Unleashes Nexe Backdoor: A New Era in Cyber Espionage Tactics

Cyble Research and Intelligence Labs (CRIL) and other analysts have identified an active July 2024 Patchwork APT campaign that uses malicious LNK files to trigger PowerShell downloads of a benign-looking PDF and a malicious DLL. The DLL is executed via WerFaultSecure.exe DLL sideloading, decrypts and runs shellcode that patches AMSI/ETW to evade detection, collects system/user data (hashed and encrypted with SHA256 and Salsa20), maintains persistence via a scheduled 'EdgeUpdate' task, and exfiltrates data to a hardcoded C2 domain (iceandfire.xyz).