The post presents Moonlight Tiger, which it also names APT-C-09, as a suspected Indian cyber-espionage group. It has been active since at least 2015 and is linked to the names Patchwork, Dropping Elephant and Monsoon. It says the group targets foreign policy, defense and academic institutions across South and East Asia. MITRE ATT&CK tracks Patchwork but does not use the name Moonlight Tiger. It says the group is not definitively attributed. This post covers its tools, notable operations and how defenders can respond.
Introduction
Moonlight Tiger is the post’s name for a suspected Indian cyber-espionage group that has been active since at least 2015. MITRE ATT&CK tracks the group as Patchwork and also lists it as Dropping Elephant and MONSOON. MITRE does not list Moonlight Tiger or APT-C-09. This group keeps targeting foreign policy, defense, and academic institutions across South and East Asia. The pattern suggests skilled intelligence gathering that fits India’s strategic and geopolitical goals.
Moonlight Tiger is not a disruptor or a financially motivated group. In the post’s view, it works like a state-affiliated espionage cell. MITRE ATT&CK is more careful. It says circumstantial evidence suggests Patchwork may be a pro-Indian or Indian entity, but it is not definitively attributed (MITRE ATT&CK G0040). Its campaigns include well-made phishing schemes, politically themed traps, and custom backdoors mixed with public tools. Over nearly a decade, the group has quietly moved from basic document attacks to multi-stage operations. These use cloud services, modular implants, and living-off-the-land techniques.
Who is Moonlight Tiger and what does it want?
Most analysts believe that Moonlight Tiger consists of actors based in India or linked to Indian strategic interests. The group seems to add to the intelligence work that supports traditional human intelligence efforts. Its focus reflects India’s geopolitical concerns. These include countering China and Pakistan and following changes in South Asian defense and policy.
The group’s main motivations include:
1. Geopolitical Intelligence: Collecting strategic data from regional rivals like China and Pakistan.
2. Defense and Policy Surveillance: Watching changes in defense buying, military development, and foreign policy think tanks.
3. Regional Influence Operations: Watching diplomatic, academic, and research bodies that shape the story around South Asian security.
Moonlight Tiger’s operations often combine opportunism with precision. They line up with major policy events, bilateral meetings, or military exercises that involve Indian interests.
What tactics and techniques does Moonlight Tiger use?
The group uses a mix of social engineering, its own malware, and open-source tools. It uses them to get into networks and stay there.
1. Initial Access
The main way the group gets in is spearphishing. Emails often pretend to come from trusted government, defense, or academic contacts. Attached documents exploit vulnerabilities in Microsoft Office (e.g., CVE-2017-0199, CVE-2018-0802). Or they use embedded macros to run PowerShell scripts. At the same time, Moonlight Tiger runs watering-hole attacks on websites that defense analysts and policy researchers visit.
2. Execution and Persistence
Once inside, the group stays in place through registry changes, scheduled tasks, and DLL side-loading. It often uses custom droppers that look like real Indian government or research files. Many of these droppers release malware like BADNEWS, Ragnatela, or open-source implants (Meterpreter, QuasarRAT). They are built to stay hidden and to be flexible.
3. Command and Control (C2)
Moonlight Tiger’s C2 setup relies heavily on HTTP/S channels hosted on compromised servers. The group prefers cloud-based platforms and public hosting providers for C2 staging. It encrypts its traffic with SSL so it is not detected. PowerShell and Python scripts are often used to deliver payloads and steal data.
4. Malware and Tools
The group’s custom toolkit combines unique and publicly available parts:
– BADNEWS: A longstanding backdoor that allows file theft and command execution.
– Ragnatela: A modular RAT with anti-analysis features and encrypted C2 communication.
– Meterpreter / QuasarRAT: Open-source tools for discreet remote access.
– Java-based Implants: Sometimes used against mixed-platform environments in diplomatic and research networks.
5. Exfiltration and Lateral Movement
Moonlight Tiger uses legitimate cloud services and temporary file-sharing platforms to steal data. Credentials stolen through phishing are often reused to move around inside target environments. The group also uses batch scripts and PowerShell-based tools to look for valuable systems.
- Initial accessSpearphishing emails and watering-hole attacksTechnique T1566.001 (MITRE ATT&CK, opens in a new tab)
- Execution and persistenceRegistry changes, scheduled tasks, DLL side-loading and droppers
- Command and controlHTTP/S traffic to compromised servers and cloud platforms
- ExfiltrationLegitimate cloud and temporary file-sharing services
- Lateral movementReused phished credentials, batch scripts and PowerShell tools
What operations has Moonlight Tiger run?
Moonlight Tiger’s campaigns show a long-term commitment to espionage and to information dominance in South Asia.
2016 – Dropping Elephant Campaign: One of the first publicly documented operations. It targeted Chinese diplomatic and media organizations with harmful RTF documents. This marked the group’s entry into the wider APT field.
2018 – Patchwork Expansion: Focused on Pakistani defense and foreign affairs bodies. Introduced the BADNEWS RAT, sent in phishing emails disguised as academic research papers.
2023 – Orange Athos Campaign: Used watering-hole attacks on South Asian think tanks, and infected visitors with the Ragnatela backdoor. The operation showed better infrastructure management and encryption.
2025 – Strategic Research Phishing Campaign: Targeted Chinese and Sri Lankan defense research centers with fake conference invitations and policy-themed traps. Analysts noted better operational security, such as rotating domains and PowerShell obfuscation.
Each campaign shows that the group can adapt to new technology and to geopolitical shifts. This keeps it relevant in a competitive regional cyber environment.
Evolution and Organizational Behavior
Moonlight Tiger’s technical skill has grown a lot since its first appearances. The group’s growth mirrors the wider growth of India’s new cyber capabilities. Early operations relied on basic document exploits and simple RATs. Later campaigns used modular loaders, cloud infrastructure, and encrypted communications.
Recent intelligence shows that the group may share infrastructure or resources with other Indian-linked entities, such as SideWinder or Confucius. Each of them has its own tools and targeting patterns. This possible overlap suggests a loose network of Indian APTs. They work toward loosely aligned intelligence goals.
The group’s evolution can be divided into three phases:
2015–2017: Basic spearphishing and static malware (Dropping Elephant phase).
2018–2021: Shift to modular RATs and more organized infrastructure (Patchwork phase).
2022–2025: Adding living-off-the-land and cloud-based tactics, which show mature operations ( Moonlight Tiger phase).
Strategic Impact
Moonlight Tiger’s ongoing espionage shows India’s growing role in state-level cyber operations. The group is less visible than Chinese or Russian APTs. It still keeps a steady, intelligence-driven approach. The aim is a strategic advantage through better data.
The effects of its operations reach beyond data theft:
– Geopolitical Leverage: Intelligence gathered from regional rivals helps policy planning and diplomatic strategy.
– Technological Surveillance: Watching defense upgrades and military-industrial projects gives early warning.
– Regional Influence: Disrupting or exposing foreign narratives through targeted leaks or influence campaigns.
Moonlight Tiger focuses on soft-power targets: universities, policy institutes, and NGOs. This shows a deep understanding of data ecosystems in today’s era of hybrid warfare.
How can defenders respond to Moonlight Tiger?
1. Phishing Awareness: Give solid training and use multi-factor authentication to reduce credential theft.
2. Network Segmentation: Stop lateral movement with internal isolation and regular privilege checks.
3. Behavioral Detection: Use endpoint detection and response tools to spot unusual PowerShell or network activity.
4. Threat Intelligence Sharing: CERTs in Asia that work together can find overlaps in Moonlight Tiger’s infrastructure.
5. Cloud Security Monitoring: Watch for unusual outbound traffic to cloud platforms. This is a known way the group steals data.
Conclusion
Moonlight Tiger (APT-C-09) shows how India’s cyber-espionage landscape has changed. It is methodical, adaptable, and geopolitically focused. Its operations show an intelligence service that is getting better at joining traditional espionage goals with modern cyber plans. It pairs precise spearphishing with modular malware design. The group keeps getting into sensitive networks across Asia without much notice.
As of 2025, Moonlight Tiger remains active and keeps changing. Its path suggests steady investment in cyber capabilities to secure India’s regional strategic dominance. For defenders and policymakers, the group is a reminder that espionage is no longer limited to embassies and boardrooms. It now also happens in the unseen circuits of cyberspace.
You can download and review the sheet for all the details!
