Cybersecurity researchers at **Acronis Threat Research Unit (TRU)** have uncovered an ongoing campaign deploying a novel C/C++ implant named **PATCHCORD**. This backdoor is delivered through highly targeted, sector-specific lures, including fake VPN installers masquerading as **Afghan Telecom (AFTEL)** and legitimate telecom management tools. ### Discovery of SHEETCORD and Evolving Infrastructure Further analysis of the threat actor's infrastructure revealed another Go-based backdoor, **SHEETCORD**, which leverages **Google Sheets** for its command-and-control (C2) communications. **SHEETCORD** has been observed being delivered via a domain impersonating India's **National Informatics Center (NIC)**. According to **Darrel Virtusio**, **Santiago Pontiroli**, and **Subhajeet Singha** from Acronis TRU, the campaign's C2 infrastructure is centralized, utilizing a single server with multiple associated domains. These include domains designed to impersonate Afghan telecom operators and even a hijacked legitimate healthcare domain. ### Attributing the Attacks to APT36 Researchers have attributed this activity with moderate confidence to **APT36** (aka **Transparent Tribe**), a Pakistan-aligned threat actor. This assessment is based on significant overlaps in targeting patterns, similarities in malware characteristics, shared infrastructure, and consistent operational tradecraft observed in previous campaigns by the group. ### PATCHCORD's Infection Chain and Capabilities The initial compromise typically begins with a ZIP archive, such as "Telecom_TMS.zip," containing an Inno Setup installer named "TMS_AfghanTelecom.exe." This installer is responsible for deploying **PATCHCORD**. The term TMS refers to the **Transport Management System**, an internal system used by **Afghan Telecom** to manage corporate vehicle and transport requests. Upon execution, **PATCHCORD** conceals its console window and establishes persistence by hijacking browser shortcuts for **Google Chrome**, **Microsoft Edge**, and **Mozilla Firefox**, provided it has elevated privileges. It then fingerprints the compromised host and registers with its C2 server (e.g., "46.30.188[.]13") to receive commands. Its capabilities include: * Adjusting C2 beacon intervals. * Enumerating running processes. * Decoding, decrypting, and executing shellcode payloads received from the C2 server in memory. * Executing arbitrary commands via `cmd.exe`. * Providing interactive control over the browser shortcut hijacking persistence mechanism. Acronis highlights that when launched via a hijacked browser shortcut, **PATCHCORD** transparently starts the legitimate browser before executing in the background. This maintains the expected user experience while ensuring persistence. The implant also checks for a specific **Windows Registry** value, "BeaconBrowserHijack," to determine if the system has been previously compromised, skipping the shortcut hijacking if it exists. ### SHEETCORD's Distinct Features Further investigation into the threat actor's infrastructure revealed a campaign targeting Indian government IT networks, utilizing a fake website mimicking **NIC** ("nic-support[.]site") to deploy **SHEETCORD**. This backdoor combines functionalities seen in **SHEETCREEP** with those of **PATCHCORD**. **SHEETCORD** offers remote command execution via **PowerShell** instead of `cmd.exe`, gathers basic host information, and uses the **Windows Startup** folder for persistence via a Visual Basic Script. It also incorporates **PATCHCORD**'s browser shortcut hijacking mechanism, extending its reach to **Brave**, **Opera**, and **Vivaldi**, and uniquely uses the **Google Sheets API** for C2 communications. ### Evolving Toolkit and AI-Assisted Malware **PATCHCORD** has been active since at least March 2026, with a variant targeting India's energy sector incorporating anti-analysis and anti-debugging techniques. An exposed staging server linked to the threat actor has provided insights into their evolving offensive toolkit, which includes open-source C2 frameworks such as **antnium**, **GateSentinel**, and **SuperShell**. The toolkit also features exploits for **CVE-2024-6387** (an **OpenSSH** vulnerability) and AI-assisted malware projects. One notable AI-assisted project is **HACKERAI C2**, which shares overlaps with both **PATCHCORD** and **SHEETCORD**. **HACKERAI C2** uses **GitHub Gists** for C2 and implements dedicated upload and download functionalities for tasking and data exfiltration. Acronis concludes that this campaign signifies an evolution in **Transparent Tribe**'s operations. While the group historically focused on government, military, and diplomatic entities in India and South Asia, this investigation reveals a stronger operational focus on Afghan telecom providers, alongside government, defense, and energy organizations. The use of three previously undocumented malware families and the adoption of **Google Sheets** and **GitHub Gists** for C2 further demonstrate the group's continuous evolution in both targeting priorities and operational tradecraft.