New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
A sophisticated campaign is deploying a new C/C++ backdoor named PATCHCORD against Afghan telecom providers and South Asian critical infrastructure, with a related Go-based backdoor, SHEETCORD, targeting Indian government networks.
A newly identified backdoor, dubbed PATCHCORD, is actively targeting Afghan telecom providers and critical infrastructure organizations across South Asia. Threat actors are employing sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL), to distribute the C/C++ implant. This campaign highlights a growing trend of targeted attacks against vital communication and infrastructure sectors in the region.
Further analysis of the threat actor's infrastructure has revealed a second malware family, SHEETCORD, a Go-based backdoor that leverages Google Sheets for its command-and-control (C2) communications. This Go implant has been observed being delivered via a domain that mimics India's National Informatics Center (NIC), indicating a broad targeting strategy that spans both telecommunications and government entities.
Researchers at Acronis Threat Research Unit (TRU) attribute the campaign with moderate confidence to APT36, also known as Transparent Tribe, a Pakistan-aligned threat actor. This assessment is based on observed overlaps in targeting patterns, similarities in malware functionalities, shared infrastructure, and consistent operational tradecraft. The campaign's infrastructure is notably centralized around a single C2 server hosting multiple domains, some of which impersonate Afghan telecom operators, and one that was previously a legitimate healthcare domain that has since been hijacked.
The initial infection vector for PATCHCORD often begins with a ZIP archive named "Telecom_TMS.zip." This archive contains an Inno Setup installer, "TMS_AfghanTelecom.exe," which is designed to deploy the backdoor. The installer impersonates a Transport Management System (TMS), an internal system used by Afghan Telecom. Upon execution, PATCHCORD attempts to conceal its presence, establish persistence by hijacking browser shortcuts for popular browsers like Chrome, Edge, and Firefox, and then registers with its C2 server to await further instructions.
The capabilities of the PATCHCORD backdoor are extensive, allowing it to adjust its C2 beacon interval, enumerate running processes, decrypt and execute shellcode payloads in memory, and execute arbitrary commands via cmd.exe. It also maintains interactive control over its browser shortcut hijacking persistence mechanism, ensuring its continued presence on compromised systems even after reboots.
In parallel, the SHEETCORD backdoor, targeting Indian government IT networks, employs a different persistence method using a Visual Basic Script within the Windows Startup folder. It also incorporates PATCHCORD's browser shortcut hijacking technique but extends its reach to include Brave, Opera, and Vivaldi browsers. Crucially, SHEETCORD utilizes the Google Sheets API for its C2 communications, a novel approach that could make detection more challenging.
PATCHCORD has been in use since at least March 2026, with one variant observed targeting India's energy sector featuring advanced anti-analysis and anti-debugging techniques. The threat actor's exposed staging server has also revealed a diverse toolkit, including open-source C2 frameworks, exploits for CVE-2024-6387, and AI-assisted malware projects like HACKERAI C2, which uses GitHub Gists for C2. This evolution in targeting priorities and operational tradecraft, including the use of multiple undocumented malware families and cloud services for C2, underscores the dynamic nature of APT36's operations.