PATCHCORD Campaign Hits Afghan Telecom and Indian Critical Infrastructure

Acronis Threat Research Unit has identified an ongoing cyber-espionage campaign delivering a previously undocumented C/C++ backdoor named PATCHCORD against Afghan telecom providers and critical-infrastructure organizations in India. The activity has been linked with moderate confidence to Pakistan-aligned APT36, also known as Transparent Tribe, based on targeting patterns, malware similarities, shared infrastructure and operational tradecraft.

PATCHCORD has been used since at least March 2026. One observed attack against India’s energy sector used a variant with anti-analysis and anti-debugging techniques. The campaign also includes a Go-based backdoor called SHEETCORD, delivered from a site impersonating India’s National Informatics Center.

Fake telecom tools deliver the implant

The Afghan-focused infection chain begins with a ZIP archive, Telecom_TMS.zip, containing an Inno Setup installer called TMS_AfghanTelecom.exe. TMS refers to Afghan Telecom’s Transport Management System, an internal platform for tracking company vehicle and transport requests. The lure impersonates Afghan Telecom, also known as AFTEL, and uses the expected context of telecom-management software.

After execution, PATCHCORD hides its console window, fingerprints the endpoint and connects to the command-and-control server at 46.30.188[.]13 for instructions. Its command set can change the beacon interval, enumerate running processes, decrypt and execute a received shellcode payload in memory, and run arbitrary commands through cmd.exe.

Browser shortcuts become a persistence layer

With elevated privileges, PATCHCORD hijacks browser shortcuts for Google Chrome, Microsoft Edge and Mozilla Firefox. When a victim opens one of those altered shortcuts, the malware launches the legitimate browser and continues in the background, preserving the expected user experience while retaining persistence.

The implant checks for the BeaconBrowserHijack value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. If it is absent, the malware writes its executable path there so the browser-shortcut routine can be activated after the current user logs in. This combination of familiar browser behavior and Registry persistence makes shortcut integrity a relevant endpoint-control issue, alongside the industrial environment threat monitoring focus on threats affecting industrial environments.

SHEETCORD broadens the infrastructure

Acronis also found nic-support[.]site, a fake National Informatics Center website aimed at Indian government IT networks. It delivers SHEETCORD, which combines elements associated with SHEETCREEP and PATCHCORD. Unlike PATCHCORD, SHEETCORD uses PowerShell for remote command execution and Google Sheets API communications for command and control.

SHEETCORD gathers basic host information, persists through a Visual Basic Script in the Windows Startup folder, and extends browser-shortcut hijacking to Brave, Opera and Vivaldi. Researchers also identified an exposed staging server containing open-source C2 frameworks including antnium, GateSentinel and SuperShell, exploit material for CVE-2024-6387, AI-assisted malware projects and campaign-specific files. One project, HACKERAI C2, uses GitHub Gists for tasking and data exfiltration.

For organizations in telecom, government, defense and energy, the practical implication is to validate software installers and download domains, monitor changes to browser shortcuts and Windows persistence locations, and investigate endpoint connections to unexpected web-based C2 services.