PATCHCORD Malware Campaign Targets Afghan Telecom and South Asian Critical Infrastructure
Summary
Acronis researchers detail a campaign targeting telecom, government, defense, and energy organizations in South Asia with PATCHCORD, SHEETCORD, and HACKERAI malware, assessing moderate-confidence links to APT36. Campaign infrastructure remained active at publication.
Key points
- Sector-themed installers, including fake Afghan Telecom VPN and telecom tools, deliver the PATCHCORD backdoor.
- PATCHCORD hijacks browser shortcuts for persistence and supports host profiling, process enumeration, remote commands, and in-memory shellcode execution.
- SHEETCORD adds Startup-folder persistence and uses Google Sheets for command-and-control; HACKERAI uses GitHub Gists.
- Researchers found a shared C2 server, appstoore[.]solutions, and an expanding set of domains impersonating Afghan and Indian organizations.
- An exposed staging server contained campaign files, C2 frameworks, credential-harvesting tools, and exploit tooling for CVE-2024-6387 and CVE-2021-4034.
- Acronis assesses with moderate confidence that the activity overlaps with APT36 or a closely related actor; the report notes insufficient evidence to link it to SilverFox.
- The campaign infrastructure remained active at publication, and Acronis says its EDR/XDR detects and blocks the threat.
Article Details
- Attack Vectors
- PATCHCORD was delivered through a malicious Inno Setup installer disguised as an Afghan Telecom VPN installer or telecom management tool.
- Spear-phishing lures and impersonation domains targeted Afghan telecom organizations and Indian government, defense, and energy entities; nic-support[.]site served the SHEETCORD installer.
- PATCHCORD persisted by adding a Run key and hijacking browser shortcuts. SHEETCORD also used a Startup-folder VBScript and Run key, and hijacked shortcuts for six browsers.
- PATCHCORD polled an HTTP C2 server and supported process enumeration, in-memory shellcode execution, and remote command execution. SHEETCORD used PowerShell for command execution and Google Sheets for C2; HACKERAI C2 Agent used GitHub Gists.
- A staging server exposed exploit tooling for CVE-2024-6387 and CVE-2021-4034, alongside credential-harvesting and brute-forcing artifacts. The article assesses that this tooling may be used to pursue initial access, but does not confirm exploitation.
- Defensive Notes
- The article says Acronis EDR / XDR detects and blocks this threat.
- The article advises South Asian organizations to remain vigilant for sector-specific phishing and monitor the reported indicators of compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | afghanistanupdates[.]site | Campaign domain designed to impersonate an Afghan government updates portal. |
| DOMAIN | afghantelecom[.]site | Campaign domain impersonating Afghan Telecom and linked to the operator's infrastructure. |
| DOMAIN | appstoore[.]duckdns[.]org | Earlier dynamic-DNS domain in the campaign infrastructure history. |
| DOMAIN | appstoore[.]solutions | Primary PATCHCORD C2 domain; the implant polls it for tasking. |
| DOMAIN | caprispine[.]health | Domain impersonating a legitimate clinic, believed by the researchers to have been used as a lure or phishing front. |
| DOMAIN | defence[.]cdga[.]site | Domain listed among campaign C2 indicators; the article associates the related historical infrastructure with distribution of HACKERAI C2 Agent. |
| DOMAIN | defence[.]cgda[.]site | Historical campaign domain impersonating India's Controller General of Defence Accounts and associated with HACKERAI C2 Agent distribution. |
| DOMAIN | nic-support[.]site | Domain impersonating India's National Informatics Centre and serving the SHEETCORD installer. |
| DOMAIN | nicservice[.]org | Campaign domain linked to the operator's infrastructure; the article says it was retired after its last observed resolution. |
| DOMAIN | servicesindia[.]services | Campaign domain linked through infrastructure pivoting to the operator's server. |
| DOMAIN | vpn01[.]afghantelecom[.]site | Domain impersonating an Afghan Telecom VPN portal and associated with the AFTEL_VPN_Setup.exe lure. |
| DOMAIN | www[.]afghanistanupdates[.]site | Listed as a campaign C2 domain. |
| DOMAIN | www[.]appstoore[.]solutions | Listed as a campaign C2 domain. |
| DOMAIN | www[.]caprispine[.]health | Listed as a campaign C2 domain. |
| DOMAIN | www[.]nicservice[.]org | Listed as a campaign C2 domain. |
| DOMAIN | www[.]servicesindia[.]services | Listed as a campaign C2 domain. |
| DOMAIN | www[.]zala-aer[.]info | Listed as a campaign C2 domain. |
| DOMAIN | zala-aer[.]info | Campaign domain linked through infrastructure pivoting to the operator's server. |
| IPV4 | 108[.]187[.]42[.]63 | Separate server exposing the same SuperShell C2 response; the article notes a ValleyRAT association but reports no attribution or operational link to this campaign. |
| IPV4 | 46[.]30[.]188[.]13 | Campaign C2 server hosting infrastructure used by PATCHCORD and associated campaign domains. |
| SHA256 | 0f4073d3c866bc3daf55b25f71250b96ec120db94a4f9cc8fe85b7c9f9d346b3 | Hash identified for the PATCHCORD agent.exe artifact. |
| SHA256 | 1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94 | Hash identified for the AFTEL_VPN_Setup.exe installer/dropper. |
| SHA256 | 2323b55ea743c813e48689318e8ed54ae838cf9e8a2adbfc2488ea8a36dd0126 | Hash identified for the JitsiMeet-Setup.exe installer/dropper. |
| SHA256 | 2eddfebb3f7419af27493a6a3bb601372cf6c494da8df62640cce7f830b4a73b | Additional installer/dropper hash listed in the article without an associated filename. |
| SHA256 | 378484112b4e837d3850b5b0802fc509202c232bb124d6944a59fe66525ba668 | Hash identified for the MDEB_Update_Setup.exe installer/dropper. |
| SHA256 | 50fc220347f9e281037e831c3755dc70a8ba7f663025aea35b301226918b016b | Hash identified for the PATCHCORD node_service.exe artifact. |
| SHA256 | 5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a | Hash identified for the nhpcfuelconservationservice.exe installer/dropper. |
| SHA256 | 74d347785dc47f8cda3876826cdd3fb3935ac55dc8e9e0c0f96d5ef4e00089a2 | Hash identified for the HACKERAI C2 Agent.exe implant. |
| SHA256 | 959bbb09cd86ce3930406bf1cf32776ca477dfefe3fd63e90bf0017fccd90587 | Hash identified for the SHEETCORD system-agent.exe implant. |
| SHA256 | b56fab5a6834c51d85787e7c1177720dfba5a5823763f3fcf432196cd2a1bdf3 | Hash identified for the MOFA_Employee_Benefits.exe installer/dropper. |
| SHA256 | cf7184c0dfe882dc6e3016f16e4ede32b75d7648f83d6f4f87eb6a703be7b8d6 | Hash identified for the TMS_AfghanTelecom.exe installer/dropper. |
| SHA256 | d46ee94d6a27ff9f02cff6fb57780acac2833ce48c95e63042a6274e24a040bb | Hash identified for the PATCHCORD tms_launcher.exe implant. |
| SHA256 | ea0934472121848b80455581d289ce4480b1e5cc05678c1b90ecfc465b5ec350 | Hash identified for the NHPC_Fuel_Conservation_Setup.zip installer/dropper. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationInstallers and domains impersonate Afghan Telecom, India's National Informatics Centre, and other organizations to appear legitimate to targets.T1041 · Exfiltration Over C2 ChannelPATCHCORD sends command output and process-enumeration results to its C2 server; the article also describes data exfiltration through SHEETCORD's Google Sheets and HACKERAI C2 Agent's GitHub Gists.T1049 · System Network Connections DiscoveryA PATCHCORD variant scans active TCP connections for ports associated with analysis tools.T1057 · Process DiscoveryPATCHCORD enumerates running processes and returns process names, PIDs, and executable paths.T1059.001 · PowerShellSHEETCORD executes operator-supplied commands through powershell -Command.T1059.003 · Windows Command ShellPATCHCORD executes operator-supplied commands using cmd.exe /c.T1059.005 · Visual BasicSHEETCORD writes a Startup-folder VBScript that launches the implant at user logon.T1071.001 · Web ProtocolsPATCHCORD uses HTTP POST registration and recurring HTTP GET requests to its C2 endpoint.T1082 · System Information DiscoveryPATCHCORD collects the Windows edition and host details, while SHEETCORD collects the victim hostname.T1083 · File and Directory DiscoveryThe implants search user shortcut locations and enumerate shortcut files while applying browser-shortcut persistence.T1102.002 · Bidirectional CommunicationSHEETCORD uses Google Sheets for bidirectional C2 communication, and HACKERAI C2 Agent uses GitHub Gists to upload and retrieve tasking and data.T1497.001 · System ChecksA PATCHCORD variant checks for virtualization artifacts, system resources, and analysis-tool processes to identify analysis environments.T1497.002 · User Activity Based ChecksA PATCHCORD variant monitors cursor movement and user input to detect automated sandbox environments.T1497.003 · Time Based ChecksA PATCHCORD variant uses randomized 30-to-90-second delays when an anti-analysis check is triggered; HACKERAI C2 Agent also introduces randomized delays.T1547.001 · Registry Run Keys / Startup FolderPATCHCORD and SHEETCORD establish persistence by adding values under the current user's Windows Run registry key.T1547.009 · Shortcut ModificationPATCHCORD and SHEETCORD rewrite browser shortcuts to launch the implant while preserving the browser launch behavior.T1620 · Reflective Code LoadingPATCHCORD decrypts received shellcode, allocates executable memory, and runs it in a new thread without writing it to disk.
CVE
CVE-2021-4034open-source browser credential harvesting tool, exploit tooling for CVE-2024-6387 (regreSSHion) and CVE-2021-4034 (PwnKit), and credential brute-forcing artifacts including hydra.restore and rockyou_2025_05.txt.CVE-2024-6387C2 framework, multiple RAT frameworks, credential harvesting tools, and exploit tooling for CVE-2024-6387 (regreSSHion). This research details TRU's analysis of the PATCHCORD, SHEETCORD and HACKERAI C2 Agent
People
Threat Actors
Malware
HACKERAI C2 AgentCVE-2024-6387 (regreSSHion). This research details TRU's analysis of the PATCHCORD, SHEETCORD and HACKERAI C2 Agent malware families, their C2 mechanisms and the supporting infrastructure.PATCHCORDPATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructureSHEETCORDimpersonating Afghan Telecom (AFTEL) and telecom management tools. Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2SHEETCREEP RATThe Go-based malware combines functionality previously observed in the SHEETCREEP RAT with several capabilities introduced in PATCHCORD, suggesting an evolution of the operator's tooling.ValleyRATC2 response on TCP port 8080. This infrastructure was independently documented by Kaspersky as a ValleyRAT C2 server associated with the SilverFox ABCDoor campaign. While this represents an interesting
Vendors
AcronisAcronis Threat Research UnitGitHubCombined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for C2, the campaign demonstrates continued evolution in both the group's targeting priorities andGooglepivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's
Products
Acronis EDR / XDRThis threat is detected and blocked by Acronis EDR / XDR:Bravewhich targets three browsers, the Go-based implant expands support to six: Chrome, Firefox, Edge, Brave, Opera, and Vivaldi.GitHub GistsCombined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for C2, the campaign demonstrates continued evolution in both the group's targeting priorities andGoogle ChromeBefore modifying shortcuts, the implant checks whether it is running with elevated privileges and then attempts to hijack shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox.Google Sheetsuncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India'sMicrosoft EdgeMicrosoft Edge path argument and browser-launch threadPATCHCORD operates in two execution modes.Microsoft WindowsThe extracted TMS_Launcher.exe is a 64-bit Windows executable compiled with the Microsoft Visual C/C++ (MSVC) toolchain and serves as the primary PATCHCORD implant.Mozilla FirefoxBefore modifying shortcuts, the implant checks whether it is running with elevated privileges and then attempts to hijack shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox.Operawhich targets three browsers, the Go-based implant expands support to six: Chrome, Firefox, Edge, Brave, Opera, and Vivaldi.Vivaldithree browsers, the Go-based implant expands support to six: Chrome, Firefox, Edge, Brave, Opera, and Vivaldi.
Tools
antniumthe campaign files, the directory also revealed the operator's broader offensive toolkit. We identified antnium/, an open-source Go-based C2 framework for initial access publicly available on GitHub, which is notableGateSentinel-C2-Rat-Hvncthe operator has a strong preference for Go-based tooling. The directory also contained GateSentinel-C2-Rat-Hvnc/, the GateSentinel C2 framework independently documented by researchers at Bitdefender as partHackBrowserDatasignature flagged on this IP and the open port 4444 observed during our initial scans. We also found HackBrowserData/, an open-source browser credential harvesting tool, exploit tooling for CVE-2024-6387 (regreSSHion)Metasploit FrameworkInfrastructure analysis also identified artifacts associated with the Metasploit and SuperShell C2 frameworks on the same server. This suggests the operator may leverage these frameworks to generate shellcode payloadsSuperShellhealthcare domain. An exposed staging server revealed the operator's broader toolkit, including SuperShell C2 framework, multiple RAT frameworks, credential harvesting tools, and exploit tooling for
Countries
Afghanistanlures targeting Afghan Telecom (AFTEL), Salaam Telecom through Bonus_Salaam_telecom.zip, and Afghanistan's Ministry of Communications and Information Technology through the Ministry of Communication &IndiaGoogle Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's National Informatics Centre (NIC).Pakistanthat the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor based on targeting, malware similarities, infrastructure and operational tradecraft.
Industries
Critical infrastructurePATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructureDefenseinvestigation identified a stronger operational focus on Afghan telecom providers alongside government, defense and energy organizations. Combined with three previously undocumented malware families and the use ofEnergyidentified a stronger operational focus on Afghan telecom providers alongside government, defense and energy organizations. Combined with three previously undocumented malware families and the use of Google SheetsGovernmentan evolution of Transparent Tribe's recent operations. While the group has historically focused on government, military and diplomatic organizations in India and the broader South Asian region, our investigationTelecommunications