Backdoor Targets Afghan Telecom and Indian Infrastructure, Acronis Says

Afghan telecommunications companies and critical infrastructure organizations across South Asia have become targets of a previously unknown backdoor called PATCHCORD, according to a report published by the Acronis Threat Research Unit. The malware, written in C/C++, arrives disguised as sector-specific lures such as fake VPN installers mimicking Afghan Telecom (AFTEL) and telecom management tools. Researchers analyzing the threat actor's infrastructure also uncovered a second backdoor, SHEETCORD, built in Go and using Google Sheets for command-and-control communications, delivered via a domain impersonating India's National Informatics Center.

The attack begins with a ZIP file labeled "Telecom_TMS.zip" containing an Inno Setup installer that deploys PATCHCORD. Once running, the backdoor hides its console window, fingerprints the infected machine, and contacts a command-and-control server at 46.30.188[.]13 to await instructions. It establishes persistence by hijacking browser shortcuts for Google Chrome, Microsoft Edge, and Mozilla Firefox after confirming it has elevated privileges, then checks a Windows Registry value called "BeaconBrowserHijack" to avoid redundant compromises. The malware can adjust its beacon interval, list running processes, decode and execute shellcode payloads in memory, run arbitrary commands through cmd.exe, and control its browser hijacking persistence mechanism. SHEETCORD combines capabilities from SHEETCREEP and PATCHCORD, executes remote commands via PowerShell instead of cmd.exe, collects basic host data, uses the Windows Startup folder with a Visual Basic Script for persistence, extends browser shortcut hijacking to Brave, Opera, and Vivaldi, and relies on the Google Sheets API for command-and-control. PATCHCORD has been active since at least March 2026, with one variant targeting India's energy sector incorporating anti-analysis and anti-debugging features to evade detection.

Researchers Darrel Virtusio, Santiago Pontiroli, and Subhajeet Singha attribute the campaign to APT36, also known as Transparent Tribe, a Pakistan-aligned threat actor, with moderate confidence based on targeting patterns, malware resemblance, shared infrastructure, and operational methods. "The campaign's infrastructure centers on a single C2 server with multiple associated domains, including domains impersonating Afghan telecom operators and a hijacked legitimate healthcare domain," the researchers wrote. When launched through a hijacked browser shortcut, PATCHCORD "transparently starts the legitimate browser before continuing execution in the background, preserving the expected user experience while maintaining persistence," Acronis noted. An exposed staging server connected to the threat actor revealed their evolving toolkit, including open-source command-and-control frameworks like antnium, GateSentinel, and SuperShell, exploits for CVE-2024-6387, AI-assisted malware projects, and campaign-specific files, among them HACKERAI C2, which overlaps with PATCHCORD and SHEETCORD but uses GitHub Gists for command-and-control and implements dedicated upload and download functionality for tasking and data theft.

The campaign marks an evolution in Transparent Tribe's recent operations, which have historically concentrated on government, military, and diplomatic organizations in India and the broader South Asian region, the report states. Investigators identified a stronger operational focus on Afghan telecom providers alongside government, defense, and energy organizations. Combined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for command-and-control, the campaign demonstrates continued evolution in both the group's targeting priorities and operational tradecraft, according to Acronis. The emergence of browser shortcut hijacking as a persistence technique shows how threat actors continue to blend stealth with user deception, preserving normal workflows while maintaining long-term access. Organizations managing critical infrastructure should anticipate that adversaries will increasingly weaponize sector-specific tools and workflows to bypass traditional defenses, demanding deeper scrutiny of trusted internal applications.