Malware News Acronis TRU researchers identified an ongoing campaign delivering custom backdoor PATCHCORD against Afghan telecom providers....

[Khushal]

Content source

https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/

Introduction​

Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's National Informatics Centre (NIC).

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through...

www.acronis.com

The campaign's infrastructure centers on a single C2 server with multiple associated domains, including domains impersonating Afghan telecom operators and a hijacked legitimate healthcare domain. An exposed staging server revealed the operator's broader toolkit, including SuperShell C2 framework, multiple RAT frameworks, credential harvesting tools, and exploit tooling for CVE-2024-6387 (regreSSHion). This research details TRU's analysis of the PATCHCORD, SHEETCORD and HACKERAI C2 Agent malware families, their C2 mechanisms and the supporting infrastructure.

TRU assesses with moderate confidence that the campaign overlaps with the APT36 (Transparent Tribe) cluster based on targeting patterns, malware similarities, shared infrastructure, and operational tradecraft.

The campaign reflects an evolution of Transparent Tribe's recent operations. While the group has historically focused on government, military and diplomatic organizations in India and the broader South Asian region, our investigation identified a stronger operational focus on Afghan telecom providers alongside government, defense and energy organizations. Combined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for C2, the campaign demonstrates continued evolution in both the group's targeting priorities and operational tradecraft.

Telecom providers remain particularly attractive targets for espionage actors because they provide access to communications infrastructure, subscriber information and government communications, enabling intelligence collection that extends well beyond a single organization.

 

[Bot]

Key Takeaways

Based on the supplied Acronis TRU report, this campaign is notable for several reasons:

• PATCHCORD is described as a previously undocumented compiled C/C++ backdoor targeting Afghan telecom providers and South Asian critical-infrastructure organizations.
• SHEETCORD extends the malware’s capabilities while using Google Sheets as a command-and-control channel. This can make network detection more difficult because traffic may blend with legitimate Google services.
• The operators reportedly used sector-specific lures, including fake VPN installers and telecom management tools, along with domains impersonating Afghan and Indian institutions.
• The exposed staging server allegedly contained additional offensive and credential-theft tooling, but the presence of those tools alone does not prove that every listed capability was used in the campaign.
• The attribution to APT36/Transparent Tribe is explicitly assessed with moderate confidence, so it should be treated as an analytical assessment rather than a confirmed fact.

Defensive Considerations

Organizations in the affected sectors should prioritize:

• Allowlisting approved VPN and telecom-management software, and verifying installers through official vendor channels.
• Monitoring newly created or suspicious domains that imitate government, telecom, healthcare, or infrastructure organizations.
• Reviewing endpoint processes and persistence mechanisms associated with unauthorized remote-access tools and unknown Go or C/C++ binaries.
• Auditing OAuth permissions, browser sessions, and access to Google Workspace services, since abuse of legitimate cloud platforms can reduce the value of simple domain or IP blocking.
• Restricting outbound access from servers and workstations to only required services where practical.
• Reviewing authentication logs for unusual access, especially after execution of a suspicious installer or opening of a sector-specific lure.
• Submitting suspected samples and URLs to reputable analysis services such as VirusTotal, while avoiding the upload of confidential documents or sensitive binaries.

The report’s infrastructure and malware indicators should be validated against the original publication before being used for detection. The most important practical controls are software-source verification, application allowlisting, cloud-service monitoring, and investigation of unusual remote-access activity.