Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 21:34:24 UTC
Home > List all groups > List all tools > List all groups using tool NDiskMonitor
 Tool: NDiskMonitor
Names NDiskMonitor
Category Malware
Type Reconnaissance, Backdoor, Downloader
Description
(Trend Micro) A custom backdoor we believe to be Patchwork’s own; it can list the
infected machine’s files and logical drives, as well as download and execute a file from
a specified URL.
Information
MITRE ATT&CK AlienVault OTX Last change to this tool card: 22 April 2020
Download this tool card in JSON format
All groups using tool NDiskMonitor
Changed Name Country Observed
APT groups
 Patchwork, Dropping Elephant 2013-Jun 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=96978093-9b14-4c4e-8dbf-575ccec7c538
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=96978093-9b14-4c4e-8dbf-575ccec7c538
Page 1 of 1