InfoSecBulletin Cybersecurity for mankind
A previously undocumented backdoor called PATCHCORD actively target telecom and critical information infrastructure (CII) in South Asia. According to Acronis Threat Research Unit (TRU), the backdoor is a C/C++ code that gets into systems using specific tricks, like fake VPN installers pretending to be Afghan Telecom (AFTEL) and telecom management software.
An analysis of the hacker’s setup has found another Go-based backdoor called SHEETCORD that uses Google Sheets for communication. The malware appears to be sent through a domain pretending to be India’s National Informatics Center (NIC).
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
“The campaign’s infrastructure centers on a single C2 server with multiple associated domains, including domains impersonating Afghan telecom operators and a hijacked legitimate healthcare domain,” researchers Darrel Virtusio, Santiago Pontiroli, and Subhajeet Singha said.
Reports suggest that it could be the work of a Pakistan-linked group called APT36 (or Transparent Tribe) with some certainty. They point to similarities in targets, malware, shared tools, and methods used.
The first thing is a ZIP file called “Telecom_TMS.zip.” Inside is an installer (“TMS_AfghanTelecom.exe”) that helps set up PATCHCORD. TMS stands for Transport Management System. It is a system used by Afghan Telecom, a government-owned telecom company, to manage vehicle and transport requests.
Upon execution, the backdoor conceals its console window, sets up persistence by hijacking browser shortcuts associated with Google Chrome, Microsoft Edge, and Mozilla Firefox after checking it’s running with elevated privileges, fingerprints the host, and registers with its C2 server (“46.30.188[.]13”) to receive tasking commands that allow it to :
Adjust C2 beacon interval
Enumerate all running processes
Decode and decrypt a shellcode payload received from the C2 server and execute it in memory
Execute arbitrary commands via “cmd.exe”
Provide interactive control over the browser shortcut hijacking persistence mechanism
“When launched through a hijacked browser shortcut, it transparently starts the legitimate browser before continuing execution in the background, preserving the expected user experience while maintaining persistence,” Acronis said. “Otherwise, it proceeds directly to its primary functionality.”
The implant also checks for a Windows Registry value named “BeaconBrowserHijack” under “HKCU\Software\Microsoft\Windows\CurrentVersion\Run.” If the value already exists, it skips the shortcut hijacking process, assuming the system has already been compromised.
If this is not true, it saves its own path to the Windows Registry and keeps it running after restarts to start the browser shortcut hijacking process whenever the user logs into Windows.
Further checking of the threat actor’s setup has found a campaign aimed at Indian government IT networks. This includes a fake website that looks like NIC (“nic-support[.]site”) to release SHEETCORD, which mixes features from SHEETCREEP and PATCHCORD.
The backdoor allows remote command execution with PowerShell instead of “cmd.exe,” collects basic host info, and uses the Windows Startup folder to stay active with a Visual Basic Script. It includes PATCHCORD’s way of hijacking browser shortcuts to target Brave, Opera, and Vivaldi, and uses the Google Sheets API for C2.
PATCHCORD is reported to have been used by the threat actor since at least March 2026. One attack focused on India’s energy sector using a backdoor that has tricks to avoid detection.
An exposed staging server connected to the threat actor has revealed details about their changing attack tools. This includes open-source command and control frameworks like antnium, GateSentinel, and SuperShell, exploits for CVE-2024-6387, AI-driven malware projects, and files for specific campaigns.
HACKERAI C2 is an AI project that works with PATCHCORD and SHEETCORD. It uses GitHub Gists for C2 and has special features for uploading and downloading tasks and data.
“The campaign reflects an evolution of Transparent Tribe’s recent operations,” Acronis said. “While the group has historically focused on government, military and diplomatic organizations in India and the broader South Asian region, our investigation identified a stronger operational focus on Afghan telecom providers alongside government, defense and energy organizations.”
“Combined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for C2, the campaign demonstrates continued evolution in both the group’s targeting priorities and operational tradecraft.”
Indicators of Compromise
SHA256 (Installers / Droppers):
TMS_AfghanTelecom.exe
cf7184c0dfe882dc6e3016f16e4ede32b75d7648f83d6f4f87eb6a703be7b8d6
AFTEL_VPN_Setup.exe
1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94
NHPC_Fuel_Conservation_Setup.zip
ea0934472121848b80455581d289ce4480b1e5cc05678c1b90ecfc465b5ec350
nhpcfuelconservationservice.exe
5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a
MDEB_Update_Setup.exe
378484112b4e837d3850b5b0802fc509202c232bb124d6944a59fe66525ba668
MOFA_Employee_Benefits.exe
b56fab5a6834c51d85787e7c1177720dfba5a5823763f3fcf432196cd2a1bdf3
JitsiMeet-Setup.exe
2323b55ea743c813e48689318e8ed54ae838cf9e8a2adbfc2488ea8a36dd0126
N/A
2eddfebb3f7419af27493a6a3bb601372cf6c494da8df62640cce7f830b4a73b
SHA256 (PATCHCORD):
tms_launcher.exe
d46ee94d6a27ff9f02cff6fb57780acac2833ce48c95e63042a6274e24a040bb
node_service.exe
50fc220347f9e281037e831c3755dc70a8ba7f663025aea35b301226918b016b
agent.exe
0f4073d3c866bc3daf55b25f71250b96ec120db94a4f9cc8fe85b7c9f9d346b3
SHA256 (SHEETCORD):
system-agent.exe
959bbb09cd86ce3930406bf1cf32776ca477dfefe3fd63e90bf0017fccd90587
SHA256 (HACKERAI C2):
Agent.exe
74d347785dc47f8cda3876826cdd3fb3935ac55dc8e9e0c0f96d5ef4e00089a2
C2 domains:
appstoore[.]solutions
www[.]appstoore[.]solutions
afghantelecom[.]site
afghanistanupdates[.]site
www[.]afghanistanupdates[.]site
caprispine[.]health
www[.]caprispine[.]health
servicesindia[.]services
www[.]servicesindia[.]services
zala-aer[.]info
www[.]zala-aer[.]info
nicservice[.]org
www[.]nicservice[.]org
nic-support[.]site
appstoore[.]duckdns[.]org
defence[.]cdga[.]site
C2 IP:
46.30.188.13 (AS 199959, Gwy IT Pty Ltd, Netherlands)
Registry persistence:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BeaconBrowserHijack (PATCHCORD)
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemHelper (SHEETCORD)
Startup persistence (SHEETCORD):
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.vbs
User-Agent:
Beacon/1.0.0
