Fake VPN installers are delivering a new backdoor to Afghan telecoms and South Asian infrastructure, with ties to APT36.