Advanced persistent threats (APTs) are now on the security radar. As noted by BizTech Magazine, 49 percent of enterprises surveyed believe it is “very likely” they will come under fire from these sophisticated threats. Just 15 percent, however, said they were “very prepared” to deal with an APT attack.

According to eWEEK, meanwhile, things may get worse before they get better: Security firm Cymmetria has discovered a new APT named Patchwork, which uses copy-pasted code to carry out its dirty work.

It’s All Been Done Before

Cymmetria first noticed Patchwork in December of last year. Since then, the malware has compromised 2,500 government agencies and companies across Southeast Asia. Upon closer inspection, the security firm discovered a common infection vector: targeted spear phishing using a malicious PowerPoint attachment.

But instead of using new code or a clever variant of existing vulnerabilities, the APT simply leverages CVE-2014-4114 — also known as Sandworm — to infect target machines. Sandworm was patched by Microsoft in 2014.

Once compromised, Patchwork uses the open-source Meterpreter to carry out a reverse shell attack and gain total device access. Cymmetria Founder Gadi Evron put the criminals’ reuse of existing exploits into context in a recent Threatpost piece.

“Those behind these attacks have copied, pasted and pieced together everything from penetration tools, malware and post-intrusion attack tools,” Evron told the source. In other words, why should criminals reinvent the wheel when they can roll in on someone else’s tires and take off with critical data?

Patchwork Sets a Low Bar

According to Infosecurity Magazine, much of the criminals’ new code came from GitHub code repositories and Dark Web malware sites. The result is a kind of low-tech hybrid that shouldn’t really enjoy any measure of success.

It’s also notable that the malware is potentially of Indian origin because the country has been relatively quiet in the world of cybercrime. It might be this lack of experience that led to a copy-and-paste job rather than a new build, or it may have been the appeal of simply getting the code out in the wild.

Whatever the reason, the code has been successful at infiltrating specific targets, such as those organizations connected to military or political endeavors — despite its piecemeal nature. The idea that Patchwork enjoys success greater than the sum of its parts is the most worrisome aspect of this APT.

It’s a wake-up call for organizations: If even cobbled-together code can smash through corporate defenses to grab critical data, what happens when someone decides to build a new malware model?

Bottom line? The 85 percent are right: They’re not prepared to handle an APT attack, even one like Patchwork. It’s time to start stitching together a better digital defense.