Patchwork dumped the login data database from

Patchwork used Base64 to encode C2 traffic.(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Patchwork ran a reverse shell with Meterpreter.(Citation: Cymmetria Patchwork)

Patchwork used JavaScript code and .SCT files on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Patchwork used

PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

Patchwork bypassed User Access Control (UAC).(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Patchwork collected and exfiltrated files from the infected system.(Citation: Cymmetria Patchwork)|