ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

SHEETCREEP

0 mentions in 7 days · 0 in 30 days · 1 total · first seen · last

Search everything

Timeline

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.

Acronis TRU described an ongoing Pakistan-aligned campaign attributed with moderate confidence to APT36, delivering a previously undocumented C/C++ backdoor named PATCHCORD via fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. PATCHCORD persists by hijacking browser shortcuts for Chrome, Edge, and Firefox, registers with a single C2 server, and executes shellcode and arbitrary cmd.exe commands. Infrastructure analysis revealed SHEETCORD, a Go backdoor combining SHEETCREEP and PATCHCORD features that uses Google Sheets for C2 and a PowerShell-based remote execution, delivered via a fake site mimicking India's National Informatics Center. APT36 has used PATCHCORD since at least March 2026, including a variant with anti-analysis features used against India's energy sector, and the toolkit includes antnium, GateSentinel, SuperShell, and exploits for CVE-2024-6387.

The Hacker News · Aug 15, 2026Threat actor in the wildCVE-2024-6387

Related CVEs

  • CVE-2024-63878.1100%
    A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).
    A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
    · sonicwall sma 6200 firmware · sonicwall sma 7200 firmware PoC ×7—

Appears with

threat actor APT36 1threat actor Transparent Tribe 1malware PATCHCORD 1malware SHEETCORD 1organization National Informatics Center 1product PATCHCORD 1product SHEETCORD 1vendor Acronis 1vendor Afghan Telecom 1victim Afghan Telecom 1victim National Informatics Center 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.