New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations are the targets of a new campaign delivering a previously undocumented backdoor called PATCHCORD, according to Acronis Threat Research Unit (TRU). The campaign also deploys a second Go-based backdoor, SHEETCORD, which uses Google Sheets for command-and-control (C2) communications.

The threat actor, assessed with moderate confidence to be the Pakistan-aligned APT36 (aka Transparent Tribe), uses sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. The initial infection vector is a ZIP archive named “Telecom_TMS.zip” containing an Inno Setup installer that delivers PATCHCORD. The backdoor establishes persistence by hijacking browser shortcuts for Chrome, Edge, and Firefox, and communicates with a C2 server at 46.30.188[.]13.

PATCHCORD can adjust C2 beacon intervals, enumerate processes, execute shellcode in memory, run commands via cmd.exe, and control the browser shortcut hijacking mechanism. A separate campaign targets Indian government IT networks using a fake NIC website (nic-support[.]site) to deploy SHEETCORD, which combines features of SHEETCREEP and PATCHCORD, uses PowerShell for remote command execution, and leverages Google Sheets API for C2.

Since at least March 2026, PATCHCORD has been used in attacks, including against India’s energy sector with anti-analysis and anti-debugging techniques. An exposed staging server revealed additional tools, including open-source C2 frameworks (antnium, GateSentinel, SuperShell), exploits for CVE-2024-6387, and AI-assisted malware projects like HACKERAI C2, which uses GitHub Gists for C2.

The campaign reflects an evolution of Transparent Tribe’s operations, expanding from traditional targets to Afghan telecom providers and critical infrastructure in South Asia.