An Indian-linked cyber-espionage group, PatchWork accidentally exposed their operations to security researchers after infecting themselves with their own custom remote access trojan (RAT).During PatchWork's most recent campaign in late November to early December, Malwarebytes Labs observed the threat actors using malicious RTF documents impersonating Pakistani authorities to infect targets with a new variant of the BADNEWS RAT, known as Ragnatela.Ironically, all the data obtained on this group was obtained when they infected themselves with their own malware, resulting in researchers being able to view numerous actions performed by them.