Trend Micro researchers reported technical and infrastructure overlaps linking the Urpage campaign with Bahamut, Confucius and Patchwork. Those observations support a connection between the campaigns, but they do not prove that one operator ran all four or identify a common sponsor. The findings are an August 2018 snapshot, not an assessment of current activity.
Which campaigns did researchers connect?
Urpage was at the center of the report. Trend Micro had earlier described a connection between Confucius and Patchwork; its subsequent investigation identified additional similarities involving Urpage and Bahamut. The contemporaneous account described the campaigns as connected through technical and infrastructure observations, rather than as a definitively unified operation. Trend Micro’s August 2018 analysis and SecurityWeek’s August 31, 2018 report provide the period-specific details.
Trend Micro’s 2018 Mobile Threat Landscape also described Confucius as a Windows and Android cyberespionage campaign and placed Urpage, Bahamut and Patchwork among related multiplatform campaigns. That report supplies context for how researchers viewed the relationships at the time; it does not establish the campaigns’ present-day status.
What evidence supported the connections?
The reporting points to overlaps in code, malware behavior and infrastructure. These are observable similarities researchers can use to identify relationships among campaigns, but each type of overlap has limits: tools and infrastructure can be reused, shared or supplied to different operators.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- File-stealer: A Delphi file-stealer was associated with Confucius and Patchwork.
- Android malware: Code in Urpage’s Android malware was described as similar to code associated with Bahamut.
- Infrastructure: Campaign infrastructure used by Urpage showed similarities to Patchwork’s.
- Operational context: SecurityWeek reported that Urpage targeted InPage, a word processor used for Urdu and Arabic, and described espionage-oriented data collection, malicious documents and backdoor delivery. These are details of the 2018 reporting, not evidence that the same samples or infrastructure remain active.
Do the similarities prove one group was behind all the attacks?
No. Code resemblance, shared malware behavior and infrastructure proximity can support a connection, but they do not by themselves prove common ownership, shared command or sponsor identity. A tool may be reused or sold, and infrastructure can be shared or repurposed. The sources establish reported overlaps; they leave the question of who controlled each campaign unresolved.
Trend Micro’s conclusion, as reproduced by SecurityWeek, preserved that uncertainty: “The many similarities and connections show that threat actors do not work in isolation, and that attacks do not necessarily appear from out of nowhere. This may even suggest that a single development team may be behind this attack — maybe a single paid group that has sold its tools and services to other groups with different goals and targets.” The single-team or paid-tool-supplier explanation was a possibility raised by Trend Micro, not a demonstrated attribution.
Rank #2
How current are these findings?
The analysis and its coverage date to August 2018. They describe what researchers observed then; they do not establish whether the campaigns continued, changed operators or remain active today. Read the connections as historical, evidence-based links among Urpage, Bahamut, Confucius and Patchwork—not as a current threat-status update.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
