A campaign targeting telecom firms and critical infrastructure across South Asia is spreading through fake VPN installers that closely copy Afghan Telecom. The malware behind it is PATCHCORD, a backdoor documented by Acronis researchers who link the operation with moderate confidence to APT36, the group also tracked as Transparent Tribe.
The Windows implant hijacks shortcuts for Microsoft Edge, Google Chrome, and Mozilla Firefox to gain persistence. Clicking a browser icon silently launches the malware first, then starts the real browser so nothing looks wrong. The payload can phone home on a schedule, list running processes, and take commands. It also executes shellcode entirely in memory, keeping the payload off disk, and can flip its own browser-hijacking persistence on and off remotely.
Infrastructure pivots exposed a second, more advanced implant named SHEETCORD. Written in Go, it uses the Google Sheets API for command and control, creating a dedicated spreadsheet tab per victim. A third family, HACKERAI C2 Agent, abuses GitHub Gists and shows signs of AI-assisted code generation, including leftover debug messages and a redundant double-XOR routine.
An exposed staging server revealed the operator’s toolkit: a Chinese-language C2 framework called SuperShell, multiple RAT frameworks, credential harvesters, exploit code for a known OpenSSH vulnerability, and files matching an iOS call history database format. Matching credential-harvesting tools and a shared C2 framework previously attributed to APT36 tie the cluster together, Acronis says.
Defenders touching Afghan telecom operations, Indian government systems, or South Asian energy infrastructure should treat the lures as credible and update phishing awareness training, the researchers advise. The infrastructure was still live at publication time.
