Overview

This report highlights recent activity linked to two APT groups and outlines effective ways to analyze and track it using ANY.RUN. The report includes IOCs, YARA rules, TI Lookup queries, adversary profiles, and technical details of the attacks. The analysis also covers malicious samples observed in recent campaigns. The content is intended to support threat hunting and attribution efforts.

🚨 Patchwork activity

A recent post by the RedDrip Team reports on a campaign targeting Nepal, attributed to the APT group Patchwork, and highlights the use of Spyder malware. The post also includes network indicators and information related to a digital signature.

Threat Actor Profile: Patchwork

Patchwork is an advanced persistent threat group suspected to be operating from India. Active since at least 2009, Patchwork is known for targeting organizations across Asia, primarily for espionage purposes.

Origin: India
Active Since: 2009
Motivation: Espionage
Targeted Countries: Nepal, United States, China, Pakistan, Taiwan, Malaysia, Sri Lanka, Uruguay, Bangladesh, Australia
Targeted Industries: Aviation, Defense, Energy, Finance, Government, Information Technology, Media, NGOs, Pharmaceuticals

Analysis of Related activity in ANY.RUN

Patchwork has been observed using Spyder malware in their campaigns, as demonstrated in a sample.

SHA-256: 34e260c301ee81b228d35ac721b06a3aa41fb5b07835078b5b4e2941fef8aa85
Sample: ANY.RUN

It is known that a file used in the Patchwork group’s attack was digitally signed with a certificate issued to ADATPARTNER Software und Systeme GmbH.

In the ANY.RUN analysis of the Spyder malware, this same certificate appears on the signed file, but the signature is marked as untrusted due to a broken certificate chain — one of the certificates had been revoked.

sign_spyder

Spyder malware establishes outbound HTTP communication with the remote host myprivatedrives[.]com, sending POST and GET requests to the endpoints /ticket_line/openai.php and /ticket_line/certificate.php. The requests originate from the process vpncert.exe and are likely intended for command-and-control communication.

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: url:"http://myprivatedrives.com/ticket_line/*.php"

Additional Spyder malware samples were identified using TI Lookup, featuring different hash values and code signing certificates. Spyder activity was also detected through Suricata rules associated with related network traffic.

SHA-256: 834292df9671dc76d573664343a09296287ee7a2164022a618ed789fbed4931f
Sample: ANY.RUN

🚨 APT29 activity

A recent report by Check Point Research describes a phishing campaign observed in early 2025, targeting European diplomatic entities and attributed to the Russian-linked threat actor APT29. The activity involved the use of GRAPELOADER and a new version of the WINELOADER backdoor.

Threat Actor Profile: APT29

Origin: Russia
Active Since: 2008
Motivation: Espionage, Data Theft
Targeted Countries: Germany, Italy, Romania, Greece, Azerbaijan, United States, Ukraine, Belgium, India, Portugal, Turkey, Canada, Australia, France, Spain, Singapore, Poland
Targeted Industries: Government, Energy, Healthcare, Education, Finance, Telecommunications, IT, Defence, Aerospace, Media, Logistic

Analysis of Related activity in ANY.RUN

The attackers used the domains bakenhof[.]com and silry[.]com both to send phishing emails and to host malicious payloads. According to the vendor report, the URLs hxxps://bakenhof[.]com/invb.php and hxxps://silry[.]com/inva.php were included in the emails and used to deliver the payload wine.zip. We will try to find more information about these domains using TI Lookup.

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: domainName:"bakenhof.com" OR domainName:"silry.com"

Following a search in TI Lookup based on the domains mentioned above, we identified a task involving a request to hxxps://bakenhof[.]com/invitation.php. With medium confidence, this URL can be assessed as an indicator of APT29-related activity.

We can observe the activity of wine.exe, which is delivered via the aforementioned domains and contains GRAPELOADER (ppcore.dll).

SHA-256: 653db3b63bb0e8c2db675cd047b737cefebb1c955bd99e7a93899e2144d34358
Sample: ANY.RUN

According to a report by Check Point Research, ppcore.dll includes the functions PPMain and DllGetLCID, with the malicious payload being executed specifically through PPMain. To execute the payload during analysis, we can specify the export function to be called. In this case, the function PPMain serves as the entry point that triggers the execution flow of the malicious code.

We can observe this activity in the following analysis:

SHA-256: d931078b63d94726d4be5dc1a00324275b53b935b77d3eed1712461f0c180164
Sample: ANY.RUN

We have created a simple YARA rule to search DLL files, such as ppcore.dll, using ANY.RUN YARA Search. To perform the search, simply copy the rule into the YARA Search interface.

rule GRAPELOADER_ppcore
{
    strings:
        $f1 = "PPMain" ascii
        $f2 = "DllGetLCID" ascii

    condition:
        uint16(0) == 0x5A4D and // MZ header
        $f1 and $f2
}

In APT29 activity, the use of WINELOADER in later stages of the attack is noted, delivered as vmtools.dll. The malicious payload is executed when the function Str_Wcscpy is explicitly called. We can observe this activity in the following analysis:

SHA-256: adfe0ef4ef181c4b19437100153e9fe7aed119f5049e5489a36692757460b9f8
Sample: ANY.RUN

Conclusion

This report covers two separate cases involving recent activity by the groups Patchwork and APT29, highlighting IOCs, malware samples, and execution techniques specific to each. Using ANY.RUN, we demonstrated how analysts can investigate such threats and search for related activity. These capabilities help expand understanding of each threat, reveal additional indicators, and support informed defensive actions.