APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.
Acronis Threat Research Unit documented PATCHCORD, a previously undocumented C/C++ backdoor delivered via fake VPN installers impersonating Afghan Telecom (AFTEL), which hijacks Edge, Chrome and Firefox shortcuts for persistence and executes in-memory shellcode. A related Go implant, SHEETCORD, abuses the Google Sheets API for per-victim C2 and was distributed via a domain impersonating India's National Informatics Centre, while a third tool, HACKERAI C2 Agent, uses GitHub Gists and shows signs of LLM-assisted coding. An exposed staging server revealed SuperShell, RAT frameworks, credential-harvesting tools and OpenSSH exploit code, and the researchers attribute the activity to APT36/Transparent Tribe at moderate confidence.
- PATCHCORD backdoor delivered via fake Afghan Telecom VPN installers.
- Persistence achieved by hijacking Edge, Chrome and Firefox shortcuts.
- SHEETCORD Go implant uses Google Sheets API for per-victim C2.
- Third tool uses GitHub Gists for C2, showing AI-assisted coding signs.
- Exposed staging server revealed toolkit; APT36 attribution at moderate confidence.
- ATT&CK
- T1204.002 Malicious FileT1547.009 Startup ItemsT1620 Reflective Code LoadingT1102.002 Bidirectional CommunicationT1059.001 PowerShell
- Products
- SuperShell
- Threat actors
- APT36Transparent Tribe
- Countries
- AfghanistanIndia
From the original article
5 min read at securityaffairs.com
Acronis uncovered PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2. Researchers at Acronis just documented an espionage operation that reads like it was built by someone with genuinely good taste in disguises.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.