PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

A new cyber-espionage campaign is targeting Afghan telecom providers and critical infrastructure organizations across South Asia with previously undocumented malware families.

Security researchers from Acronis Threat Research Unit identified a C/C++ backdoor named PATCHCORD and a Go-based backdoor named SHEETCORD. The activity has been assessed with moderate confidence as being linked to APT36, also known as Transparent Tribe.

The campaign has targeted Afghan telecommunications organizations as well as Indian government, energy, defense and critical-infrastructure networks. PATCHCORD has reportedly been active since at least March 2026.

Key Highlights

• Newly identified PATCHCORD C/C++ backdoor.
• SHEETCORD is a Go-based backdoor.
• Activity attributed with moderate confidence to APT36 / Transparent Tribe.
• Afghan telecom providers are a major targeting focus.
• Indian government IT and energy-sector organizations have also been targeted.
• PATCHCORD uses fake VPN installers and telecom management tools as lures.
• Browser shortcut hijacking is used for persistence.
• PATCHCORD can execute commands through cmd.exe.
• SHEETCORD uses PowerShell for remote command execution.
• SHEETCORD uses the Google Sheets API for C2.
• HACKERAI C2 uses GitHub Gists for command-and-control and data transfer.
• One observed PATCHCORD variant uses anti-analysis and anti-debugging techniques.
• The campaign has been active since at least March 2026.

Initial Access

The campaign uses sector-specific social-engineering lures designed to appear relevant to targeted organizations.

One identified infection chain begins with:

Telecom_TMS.zip

The archive contains an Inno Setup installer named:

TMS_AfghanTelecom.exe

The installer delivers the PATCHCORD backdoor.

The lure impersonates a Transport Management System associated with Afghan Telecom and is designed to appear as a legitimate internal telecommunications management application.

PATCHCORD Backdoor

PATCHCORD is a compiled C/C++ implant capable of communicating with attacker-controlled infrastructure and receiving commands.

After execution, the malware hides its console window, fingerprints the compromised host and establishes communication with its command-and-control server.

Observed capabilities include:

• Adjusting C2 beacon intervals
• Enumerating running processes
• Receiving encrypted shellcode
• Decrypting shellcode
• Executing payloads directly in memory
• Executing arbitrary commands through cmd.exe
• Controlling the browser shortcut persistence mechanism

The malware was observed communicating with the C2 address:

46.30.188[.]13

Browser Shortcut Hijacking

One of PATCHCORD's notable persistence mechanisms involves hijacking browser shortcuts.

The malware can target shortcuts associated with:

• Google Chrome
• Microsoft Edge
• Mozilla Firefox

The malicious shortcut launches the legitimate browser while simultaneously allowing the malware to continue operating in the background.

This technique helps preserve normal user behavior and may make the compromise less noticeable.

PATCHCORD also checks for the registry value:

BeaconBrowserHijack

under:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

If the value does not already exist, the malware writes its executable path to the registry to establish persistence across reboots.

SHEETCORD

Researchers also identified a second backdoor named SHEETCORD.

Unlike PATCHCORD, SHEETCORD is written in Go and uses Google Sheets as its command-and-control channel.

SHEETCORD was distributed through a website designed to impersonate India's National Informatics Center.

The malware combines capabilities from PATCHCORD and the previously identified SHEETCREEP malware.

Its capabilities include:

• Remote command execution through PowerShell
• Basic host information collection
• Browser shortcut hijacking
• Windows Startup-folder persistence
• Visual Basic Script execution
• Support for additional browsers
• Google Sheets API-based C2

SHEETCORD expands browser targeting to include Brave, Opera and Vivaldi.

Cloud-Based Command and Control

The campaign demonstrates the use of legitimate cloud services for C2.

SHEETCORD communicates with attackers through the Google Sheets API, while another project identified by researchers, HACKERAI C2, uses GitHub Gists.

Using legitimate cloud platforms can make network-based detection more difficult because the traffic may appear to be communication with trusted services.

HACKERAI C2 also includes functionality for uploading and downloading data, potentially supporting both tasking and data exfiltration.

Targeting of Indian Critical Infrastructure

The campaign has targeted Indian organizations, including government IT networks and the energy sector.

Researchers identified an attack against India's energy sector involving a PATCHCORD variant that incorporated anti-analysis and anti-debugging capabilities.

This indicates that the threat actor is actively adapting the malware to improve its ability to avoid security controls and analysis.

Threat Actor Infrastructure

An exposed staging server provided visibility into the threat actor's broader toolkit.

Researchers identified references to:

• antnium
• GateSentinel
• SuperShell
• Exploits for CVE-2024-6387
• AI-assisted malware projects
• Campaign-specific files
• HACKERAI C2

The infrastructure and operational overlaps support the assessment that the campaign is associated with APT36 / Transparent Tribe.

Detection and Hunting Opportunities

Security teams should monitor for:

• Suspicious browser shortcut modifications
• Unexpected .lnk file changes
• Registry modifications involving BeaconBrowserHijack
• Unknown executables launched through browser shortcuts
• Unauthorized entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• Suspicious PowerShell execution
• Unexpected cmd.exe child processes
• Google Sheets API communication from unusual processes
• GitHub Gist communication from endpoints
• VBS scripts launched from the Startup directory
• Unusual browser processes spawning command shells
• Memory-resident shellcode execution
• Process enumeration from suspicious executables
• Connections to 46.30.188[.]13
• Fake VPN or telecom management installers
• Files named Telecom_TMS.zip or TMS_AfghanTelecom.exe

Recommended Mitigations

1. Restrict installation of unauthorized VPN and telecom management software.
2. Monitor browser shortcut files for unauthorized modifications.
3. Monitor registry Run keys for unexpected persistence.
4. Enable PowerShell logging and command-line monitoring.
5. Monitor suspicious cmd.exe and PowerShell parent-child relationships.
6. Inspect Google Sheets API traffic originating from endpoints.
7. Monitor GitHub Gist access from corporate systems.
8. Restrict execution of unauthorized VBS scripts.
9. Implement application allowlisting for critical infrastructure systems.
10. Monitor for suspicious memory execution and shellcode behavior.
11. Conduct threat hunting for APT36 / Transparent Tribe activity.
12. Investigate endpoints that received fake VPN or telecom management installers.

Threat Assessment

PATCHCORD and SHEETCORD demonstrate an evolving cyber-espionage capability focused on telecommunications, government and critical infrastructure.

The use of browser shortcut hijacking, cloud-based C2, PowerShell execution, memory-based payload execution and anti-analysis techniques provides the threat actor with multiple mechanisms for persistence, execution and evasion.

The targeting of Indian energy infrastructure is particularly significant because compromise of such environments could provide attackers with access to sensitive operational and strategic information.

Indicators of Compromise:

• Telecom_TMS.zip — Malicious archive
• TMS_AfghanTelecom.exe — PATCHCORD installer
• BeaconBrowserHijack — Registry value
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run — Persistence location
• Google Sheets API — SHEETCORD C2
• GitHub Gists — HACKERAI C2

Conclusion

Organizations in the telecommunications, government, energy and defense sectors should proactively hunt for PATCHCORD and SHEETCORD indicators.

Security teams should prioritize browser shortcut monitoring, registry persistence detection, PowerShell telemetry, cloud-service C2 monitoring and suspicious VBS execution.

The use of legitimate services such as Google Sheets and GitHub Gists also highlights the importance of behavioral detection rather than relying exclusively on domain or IP-based blocking.