S0128: BADNEWS

BADNEWS is malware that has been used by the actors responsible for the Patchwork campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. [1] [2]

EnterpriseS0128MalwareObject v1.2ModifiedApr 25, 2025, 14:44 UTC (UTC+00:00)

S0128: BADNEWS describes [BADNEWS](https://attack.mitre.org/software/S0128) is malware that has been used by the actors responsible for the [Patchwork](https://attack.mitre.org/groups/G0040) campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. (Citation: Forcepoint Monsoon) (Citation: TrendMicro Patchwork Dec 2017)

Executive priority

S0128: BADNEWS is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0128: BADNEWS by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0128: BADNEWS appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BADNEWS

BADNEWS is malware that has been used by the actors responsible for the Patchwork campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. [1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques24 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1102.001	Dead Drop ResolverSub-technique	BADNEWS collects C2 information via a dead drop resolver.[1]CitationPaloAlto Patchwork Mar 2018[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	BADNEWS establishes a backdoor over HTTP.CitationPaloAlto Patchwork Mar 2018
Enterprise	T1113	Screen Capture	BADNEWS has a command to take a screenshot and send it to the C2 server.[1]CitationPaloAlto Patchwork Mar 2018
Enterprise	T1005	Data from Local System	When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[1]CitationPaloAlto Patchwork Mar 2018
Enterprise	T1573.001	Symmetric CryptographySub-technique	BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.[1][2]
Enterprise	T1574.001	DLLSub-technique	BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.[1]CitationPaloAlto Patchwork Mar 2018
Enterprise	T1132	Data Encoding	After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.[1]
Enterprise	T1056.001	KeyloggingSub-technique	When it first starts, BADNEWS spawns a new thread to log keystrokes.[1]CitationPaloAlto Patchwork Mar 2018[2]
Enterprise	T1102.002	Bidirectional CommunicationSub-technique	BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.[1]CitationPaloAlto Patchwork Mar 2018[2]
Enterprise	T1036.001	Invalid Code SignatureSub-technique	BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.[2]
Enterprise	T1119	Automated Collection	BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.[2]
Enterprise	T1053.005	Scheduled TaskSub-technique	BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.CitationPaloAlto Patchwork Mar 2018
Enterprise	T1039	Data from Network Shared Drive	When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[1]
Enterprise	T1132.001	Standard EncodingSub-technique	BADNEWS encodes C2 traffic with base64.[1]CitationPaloAlto Patchwork Mar 2018[2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	BADNEWS installs a registry Run key to establish persistence.[1]
Enterprise	T1025	Data from Removable Media	BADNEWS copies files with certain extensions from USB devices to a predefined directory.[2]
Enterprise	T1059.003	Windows Command ShellSub-technique	BADNEWS is capable of executing commands via cmd.exe.[1][2]
Enterprise	T1055.012	Process HollowingSub-technique	BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.[1][2]
Enterprise	T1105	Ingress Tool Transfer	BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.[1]CitationPaloAlto Patchwork Mar 2018[2]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	BADNEWS attempts to hide its payloads using legitimate filenames.CitationPaloAlto Patchwork Mar 2018
Enterprise	T1106	Native API	BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.[1][2]
Enterprise	T1074.001	Local Data StagingSub-technique	BADNEWS copies documents under 15MB found on the victim system to is the user's `%temp%\SMB\` folder. It also copies files from USB devices to a predefined directory.[1][2]
Enterprise	T1083	File and Directory Discovery	BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.[2]
Enterprise	T1120	Peripheral Device Discovery	BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.[1][2]

Associated objects

Groups, software, and campaigns

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.2
Created: May 31, 2017, 21:33 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:44 UTC (UTC+00:00)
Raw hash: 1142d9b5df78c2e9...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.2	Apr 25, 2025, 14:44 UTC (UTC+00:00)	Current bundle	`1142d9b5df78…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	Apr 25, 2025, 14:44 UTC (UTC+00:00)	Older bundle	`1142d9b5df78…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Forcepoint Monsoon
Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
Open source URL
[2]
TrendMicro Patchwork Dec 2017
Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
Open source URL
[3]
BADNEWS
(Citation: Forcepoint Monsoon)
[4]
mitre-attackS0128
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use