Afghan telecommunications providers and critical infrastructure organizations across South Asia are being targeted in an ongoing cyber espionage campaign involving a previously undocumented backdoor dubbed PATCHCORD.
The malware is a compiled C/C++ implant delivered through sector-specific phishing lures, including fake VPN installers impersonating Afghan Telecom and fraudulent telecom management tools.
Researchers have also uncovered a second backdoor, SHEETCORD, written in Go and designed to use Google Sheets as a command-and-control (C2) channel. The malware has been distributed through a website impersonating India’s National Informatics Centre (NIC).
The campaign’s infrastructure reportedly revolves around a single C2 server connected to multiple domains, including websites impersonating Afghan telecommunications companies and a compromised legitimate healthcare domain.
The activity has been attributed with moderate confidence to APT36, also known as Transparent Tribe, a Pakistan-aligned threat group. The assessment is based on similarities in targeting, malware capabilities, infrastructure, and operational techniques.
Fake Afghan Telecom Tool Delivers PATCHCORD
The campaign begins with a ZIP archive named “Telecom_TMS.zip”, containing an Inno Setup installer called “TMS_AfghanTelecom.exe.”
The installer masquerades as software associated with Afghan Telecom’s Transport Management System (TMS), an internal platform used by the state-owned telecommunications company to manage corporate transportation and vehicle requests.
Once executed, PATCHCORD hides its console window and performs several actions to establish a foothold on the compromised system.
The malware checks whether it has elevated privileges and can establish persistence by hijacking shortcuts associated with popular web browsers, including:
- Google Chrome
- Microsoft Edge
- Mozilla Firefox
PATCHCORD also collects information about the infected system before connecting to its C2 server at 46.30.188[.]13 to receive instructions.
PATCHCORD Capabilities
Once connected to its command infrastructure, the backdoor can reportedly:
- Change its C2 beaconing interval.
- Enumerate running processes.
- Receive shellcode from the C2 server, decrypt it and execute it directly in memory.
- Execute arbitrary commands through
cmd.exe. - Interact with the browser shortcut hijacking mechanism used for persistence.
The browser shortcut technique allows the malware to remain hidden from victims. When a compromised browser shortcut is launched, PATCHCORD starts the legitimate browser as expected while continuing to operate in the background.
This approach can help the malware maintain persistence without immediately disrupting normal browser activity.
Browser Shortcut Hijacking Provides Persistence
PATCHCORD also checks the Windows Registry for a value named “BeaconBrowserHijack” under:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
If the value already exists, the malware assumes the system has previously been compromised and skips the shortcut-hijacking process.
Otherwise, PATCHCORD writes its executable path to the Registry and establishes persistence across system reboots. The malicious browser shortcut mechanism is then activated when the affected user logs into Windows.
SHEETCORD Targets Indian Government Networks
Further investigation of the campaign infrastructure uncovered another operation targeting Indian government IT networks.
This activity involves a fake website designed to impersonate India’s National Informatics Centre (NIC). The site, hosted at nic-support[.]site, is used to distribute the previously undocumented SHEETCORD backdoor.
Written in Go, SHEETCORD combines capabilities associated with PATCHCORD and another malware family known as SHEETCREEP.
Unlike PATCHCORD, SHEETCORD uses PowerShell rather than cmd.exe for remote command execution.
The malware can also collect basic information about the infected system and establish persistence through the Windows Startup folder using a Visual Basic Script.
SHEETCORD incorporates PATCHCORD’s browser shortcut hijacking technique while expanding its browser coverage to include:
- Google Chrome
- Microsoft Edge
- Mozilla Firefox
- Brave
- Opera
- Vivaldi
One of its most notable features is the use of the Google Sheets API for command-and-control communications, allowing attackers to exchange instructions through a legitimate cloud service.
Energy Sector Also Targeted
PATCHCORD has reportedly been used since at least March 2026.
One campaign targeting India’s energy sector involved a variant of the malware equipped with additional anti-analysis and anti-debugging capabilities. These techniques are designed to make reverse engineering more difficult and help the malware avoid detection.
The targeting of telecommunications, government, defense and energy organizations suggests that the campaign is focused on organizations with strategically valuable information and access to critical infrastructure.
Exposed Infrastructure Reveals Expanding Toolkit
An exposed staging server associated with the threat actor has provided additional insight into the group’s evolving offensive toolkit.
The server reportedly contained a mixture of open-source command-and-control frameworks, exploits, AI-assisted malware projects and campaign-specific files.
Among the tools identified were:
- antnium, an open-source C2 framework.
- GateSentinel.
- SuperShell.
- Exploitation tools associated with CVE-2024-6387, a vulnerability affecting OpenSSH.
- AI-assisted malware development projects.
- Files specifically prepared for individual campaigns.
Another notable project, HACKERAI C2, shares capabilities with both PATCHCORD and SHEETCORD. However, it uses GitHub Gists for C2 communications and includes dedicated functionality for uploading and downloading files, potentially allowing attackers to exchange commands and exfiltrate data.
Evolving Transparent Tribe Operations
The campaign demonstrates how the threat actor’s operations are expanding beyond its traditional targets.
APT36 has historically focused on government, military and diplomatic organizations in India and across South Asia. The latest activity shows a stronger emphasis on Afghan telecommunications providers, while continuing to target government, defense and energy organizations.
The use of multiple previously undocumented malware families, browser shortcut hijacking, cloud-based C2 channels such as Google Sheets and GitHub Gists, and increasingly sophisticated anti-analysis techniques indicates an ongoing evolution in the group’s tactics.
Organizations operating telecommunications and other critical infrastructure should remain alert to phishing campaigns involving fake VPN software, telecom management tools and websites designed to imitate trusted government or industry organizations.
The campaign also highlights the growing use of legitimate cloud platforms for malware command-and-control, which can make malicious communications harder to distinguish from normal enterprise traffic.
