New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.
Acronis TRU described an ongoing Pakistan-aligned campaign attributed with moderate confidence to APT36, delivering a previously undocumented C/C++ backdoor named PATCHCORD via fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. PATCHCORD persists by hijacking browser shortcuts for Chrome, Edge, and Firefox, registers with a single C2 server, and executes shellcode and arbitrary cmd.exe commands. Infrastructure analysis revealed SHEETCORD, a Go backdoor combining SHEETCREEP and PATCHCORD features that uses Google Sheets for C2 and a PowerShell-based remote execution, delivered via a fake site mimicking India's National Informatics Center. APT36 has used PATCHCORD since at least March 2026, including a variant with anti-analysis features used against India's energy sector, and the toolkit includes antnium, GateSentinel, SuperShell, and exploits for CVE-2024-6387.
- PATCHCORD hides console, fingerprints hosts, and executes in-memory shellcode.
- SHEETCORD uses Google Sheets API for C2 and PowerShell for commands.
- Fake nic-support[.]site impersonates India's National Informatics Center.
- Campaign also deployed an AI-assisted HACKERAI C2 using GitHub Gists.
- One exposed staging server exposed the group's evolving toolkit.
- CVEs
- CVE-2024-6387
- ATT&CK
- T1204.002 Malicious FileT1547.009 Shortcut ModificationT1547.001 Registry Run Keys / Startup FolderT1102 Web ServiceT1059.001 PowerShell
- Vendors
- AcronisAfghan Telecom
- Products
- PATCHCORDSHEETCORDSHEETCREEP
- Threat actors
- APT36Transparent Tribe
- Organizations
- National Informatics Center
- Countries
- AfghanistanIndiaPakistan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-6387 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd) | 8.1 | 100% | PoC ×7 |
From the original article
3 min read at thehackernews.com
Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.