Patchwork APT Uses PowerShell Loader in New Campaign
Cyber Security News by CyberSum.net
The cyber-espionage group known as Patchwork APT has launched a new campaign using a multi-stage PowerShell loader. The attack begins with a malicious macro that downloads components designed to masquerade as the legitimate VLC media player, using DLL side-loading to execute its payload. The malware establishes persistence through a Windows Scheduled Task and uses sophisticated, layered obfuscation to hide its command-and-control communications. Once active, the final payload can perform extensive system reconnaissance, exfiltrate files, execute code in memory, and capture screenshots. This campaign demonstrates Patchwork's continued evolution in conducting stealthy intelligence-gathering operations.