Emerging tactics, techniques, and procedures (TTPs) surrounding the Indian-based Patchwork threat group are beginning to come to light due to the threat group infecting themselves with their own malware campaign. The threat campaign from Patchwork began in November and has been seen targeting numerous entities including Pakistan’s Ministry of Defense, National Defense University of Islamabad, Salim Habib University, H.E.J Research Industry of Chemistry, International Center for Chemical & Biological Sciences, and Bio-Sciences at UVAS Lahore. Patchwork threat actors are tracked under several agencies and cybersecurity companies and are also referred to as Quilted Tiger, Dropping Elephant, Zinc Emerson, and more. This threat group is motivated by espionage, targeting diplomatic and government agencies throughout Pakistan, China, United States, and think tanks worldwide. The latest campaign by the group lures specific targets with forged documents impersonating Pakistani authorities, with the end goal of infecting the target with a BADNEWS trojan variant called “Ragnatela”. This malicious package enables the ability for threat actors to execute arbitrary commands, capture keystrokes, gather screenshots, upload files, and download additional payloads. CTIX is monitoring the movements of the Patchwork threat group and will provide additional insight as needed.