PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian Critical Infrastructure (APT36-linked)
PATCHCORD, SHEETCORD & HACKERAI C2 Agent (TL-2026-2006) is a high-severity malware campaign, first published 2026-08-13 and last reviewed 2026-08-17. It is attributed to APT36 (Pakistan) with medium confidence, affects OpenSSH OpenSSH sshd, references 1 CVE (CVE-2024-6387), maps to 29 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 48 indicators of compromise.
Key facts for TL-2026-2006
- Threat ID
- TL-2026-2006
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-13
- Last reviewed
- 2026-08-17
- Attribution
- APT36
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Pakistan
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, government administration, defense, energy, critical infrastructure
- Target regions
- afghanistan, South Asia, india
- Detection rules
- 9
- Indicators of compromise
- 48
- Updates
- 2026-08-17 · 2 updates · revalidated 2× · latest source
Malware and tooling in PATCHCORD, SHEETCORD & HACKERAI C2 Agent
Malware and tooling: HACKERAI C2 Agent, HackBrowserData, PATCHCORD, SHEETCORD, SHEETCREEP, Antnium, GateSentinel, Google Sheets API, HackBrowserData, Nim-based backdoor, SuperShell, metasploit
Acronis TRU identified three previously undocumented malware families — PATCHCORD (a C/C++ backdoor), SHEETCORD (a Go implant abusing the Google Sheets API for C2), and HACKERAI C2 Agent (a Go implant using GitHub Gists for C2, showing signs of AI-assisted development) — deployed in an active cyber-espionage campaign against Afghan Telecom (AFTEL), Afghanistan's Ministry of Communications and Information Technology, India's National Hydroelectric Power Corporation (NHPC), and Indian Ministry of Defence personnel. Acronis TRU attributes the campaign with moderate confidence to APT36 (Transparent Tribe), a suspected Pakistan-linked group active since at least 2013.
How PATCHCORD, SHEETCORD & HACKERAI C2 Agent works
Acronis's Threat Research Unit (researchers Subhajeet Singha, Darrel Virtusio, and Santiago Pontiroli) traced the cluster back to a suspicious ZIP archive uploaded to VirusTotal in June 2026 that referenced Afghan Telecom (AFTEL), Afghanistan's state-owned telecom operator. Pulling the thread exposed a live attacker staging server and three distinct, previously undocumented implants sharing infrastructure and delivery lures.
PATCHCORD is a compiled C/C++ backdoor distributed via Inno Setup installers that impersonate AFTEL VPN clients and telecom-management utilities. It performs host fingerprinting, executes attacker commands via cmd.exe, and establishes persistence by hijacking browser shortcuts. SHEETCORD is a Go-language evolution of that capability that routes command-and-control through the Google Sheets API using a hardcoded GCP service-account credential, giving the operators bidirectional C2 that rides on legitimate, TLS-encrypted Google infrastructure; Acronis TRU found significant code and functionality overlap between SHEETCORD and the previously reported SHEETCREEP implant (a C# Google-Sheets backdoor attributed with medium confidence to APT36 or a related Pakistan-linked subgroup by Zscaler ThreatLabz). A live SHEETCORD lure used a domain spoofing India's National Informatics Centre (NIC) to serve an installer disguised as a "Ministry of Defense Employee Breach Update," targeting Indian Ministry of Defence and Air Force personnel. HACKERAI C2 Agent is a third Go implant, first observed in the wild in September 2025, that instead abuses GitHub Gists as its C2 channel; its code contains debugging artifacts, redundant/duplicated XOR routines, hardcoded credentials, and clear-text debug strings consistent with rapid, AI-assisted ("vibeware") development rather than hand-written tradecraft — a production style Bitdefender separately documented as an emerging APT36 pattern in March 2026.
All three implants share a persistence technique Acronis calls browser-shortcut hijacking: the malware backs up the target's existing .lnk shortcuts for Edge, Chrome, Firefox, Brave, Opera, and Vivaldi across the taskbar, Quick Launch, Start Menu, and desktop, then rewrites each shortcut to launch the implant first before silently chain-loading the legitimate browser, keeping the victim unaware. SHEETCORD additionally drops a VBScript loader into the Windows Startup folder as a secondary persistence path. Execution is largely in-memory/reflective, minimizing on-disk forensic artifacts.
The operators' staging server, still active and reachable at the time of research, hosted a large offensive toolkit alongside the three implants: Metasploit, the Chinese-language SuperShell C2 panel, the Go/C GateSentinel C2 framework (co-located directly with PATCHCORD campaign files), the open-source Go C2 framework Antnium, HackBrowserData (an open-source browser credential harvester previously linked to APT36 operations), a rockyou.txt-derived password list, a Nim-based backdoor, and working exploit tooling for CVE-2024-6387 ("regreSSHion"), the OpenSSH signal-handler race condition, apparently staged for scanning and exploiting internet-facing OpenSSH instances. The server also held artifacts suggesting a broader collection scope beyond the three Windows implants documented here — an iOS call-history database schema and router configuration-backup archives — indicating the actors may also target mobile devices and network appliances in related operations, though Acronis TRU could not confirm those capabilities are wired into PATCHCORD/SHEETCORD/HACKERAI specifically. C2 domains sat behind Let's Encrypt TLS certificates that were rotated three times, each rotation covering a different bundled set of lookalike domains (impersonating AFTEL, Salaam Telecom, Afghanistan's Ministry of Communications and IT, and India's NHPC and Controller General of Defence Accounts), consistent with deliberate infrastructure cycling to evade domain/certificate-based blocklists. Acronis also identified a secondary server geolocated to Guangdong, China, hosting artifacts associated with the unrelated ValleyRAT/SilverFox malware family; TRU assessed the overlap as infrastructure co-location rather than evidence of operational coordination between the two actors.
Acronis TRU attributes the cluster to APT36 (Transparent Tribe) with moderate confidence, citing: sustained targeting of Afghan telecom and South Asian government/defense infrastructure consistent with APT36's historical scope; the presence of HackBrowserData, previously observed in APT36 tooling; co-location of the GateSentinel C2 framework with PATCHCORD campaign files; and SHEETCORD's close technical overlap with the Google-Sheets-based SHEETCREEP implant already linked to the group. The campaign reflects a broader shift, also documented independently by Bitdefender and Zscaler, of APT36 subgroups adopting "living-off-trusted-services" C2 (Google Sheets, GitHub Gists, Firebase, Slack, Discord) and AI-accelerated malware production to blend traffic into legitimate SaaS usage and increase implant throughput.
MITRE ATT&CK techniques used in TL-2026-2006
Collection
T1005 Data from Local System; T1602.002 Network Device Configuration Dump
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.001 Command and Scripting Interpreter; T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
T1071.001 Application Layer Protocol; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Phishing; T1566.002 Spearphishing Link
Persistence
T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
T1583.001 Domains; T1583.006 Acquire Infrastructure; T1587.001 Develop Capabilities; T1587.003 Digital Certificates; T1588.002 Tool; T1588.005 Obtain Capability: Exploits
Reconnaissance
Affected products and versions in PATCHCORD, SHEETCORD & HACKERAI C2 Agent
- OpenSSH — OpenSSH sshd
Vulnerable versions: 8.5p1-9.7p1
Fixed in: 9.8p1 and later - Microsoft — Windows (desktop endpoints)
Vulnerable versions: PATCHCORD, SHEETCORD, and HACKERAI C2 Agent are Windows-targeted implants; specific build numbers not specified in reporting
Remediation for PATCHCORD, SHEETCORD & HACKERAI C2 Agent
Patches
- Upgrade OpenSSH to version 9.8p1 or later to remediate CVE-2024-6387.
Immediate actions
- Block or alert on outbound traffic to the Google Sheets API and GitHub Gists/GitHub API from endpoints in telecom, government, and defense environments where those services are not an approved business dependency.
- Audit browser shortcut (.lnk) target paths on Windows endpoints for Edge, Chrome, Firefox, Brave, Opera, and Vivaldi for unauthorized redirection to unexpected executables.
- Verify authenticity of any VPN client or telecom-management installer purporting to originate from Afghan Telecom (AFTEL) or Salaam Telecom before execution; block known impersonating domains and installer hashes once published in the Acronis IOC set.
- Patch or upgrade OpenSSH to 9.8p1 or later on all internet-facing hosts to close CVE-2024-6387 (regreSSHion).
Workarounds
- Interim mitigation for CVE-2024-6387: set LoginGraceTime to 0 in sshd_config (note: this increases exposure to a related denial-of-service condition and is not a substitute for patching).
Longer-term hardening
- Deploy EDR/behavioral detection tuned for in-memory and reflective code loading, since these implants minimize on-disk artifacts.
- Apply CASB/TLS-inspection controls to legitimate SaaS platforms (Google Sheets, GitHub, Firebase, Slack, Discord) that are increasingly abused as C2 transport by APT36-linked subgroups.
- Restrict write access to the Windows Startup folder and alert on new VBScript (.vbs) file creation there.
- Monitor for and rotate any exposed GCP service-account credentials; enforce least-privilege scoping on cloud service accounts used by internal automation to reduce reuse risk if credentials are harvested.
CVEs associated with PATCHCORD, SHEETCORD & HACKERAI C2 Agent
Weaknesses (CWE) in PATCHCORD, SHEETCORD & HACKERAI C2 Agent
CWE-362, CWE-364
Timeline of PATCHCORD, SHEETCORD & HACKERAI C2 Agent
- APT36 (Transparent Tribe) first tracked as an active, Pakistan-linked threat group targeting South Asian government, military, and diplomatic organizations.
- CVE-2024-6387 ("regreSSHion"), an OpenSSH sshd signal-handler race condition enabling unauthenticated RCE, is publicly disclosed; exploit tooling for it is later found staged on the actor's server.
- Earliest observed domain/infrastructure associated with the HACKERAI C2 Agent (GitHub Gists-based implant) becomes active.
- PATCHCORD/SHEETCORD/HACKERAI campaign infrastructure confirmed active, including domains impersonating AFTEL and related South Asian government/telecom entities.
- Actor registers the appstoore.solutions domain, later hardcoded as PATCHCORD's primary C2 domain.
- Acronis TRU telemetry places the PATCHCORD backdoor as operational since at least March 2026, initially focused on Afghan telecom providers.
- Bitdefender publishes "APT36: A Nightmare of Vibeware," documenting the group's shift to AI-assisted, high-volume ("vibeware") malware production and abuse of Google Sheets, Slack, Discord, and Firebase for C2 — a pattern later mirrored in HACKERAI C2 Agent.
- Lure domain caprispine.health first observed registered/active.
- Lure domain afghantelecom.site, impersonating Afghan Telecom (AFTEL), first observed active.
- Lure domain nicservice.org, impersonating India's National Informatics Centre, first observed active.
- Acronis TRU discovers a suspicious ZIP archive on VirusTotal referencing Afghan Telecom (AFTEL), triggering the investigation that uncovers PATCHCORD, SHEETCORD, and HACKERAI C2 Agent.
- Acronis TRU (Subhajeet Singha, Darrel Virtusio, Santiago Pontiroli) publishes findings, attributing the campaign with moderate confidence to APT36 (Transparent Tribe).
- The appstoore.solutions/46.30.188.13 C2 infrastructure confirmed still live and reachable.
- Wider public pickup of the Acronis TRU research by Security Affairs, The Hacker News, GBHackers, and CyberSecurityNews, with additional technical detail (C2 domain/IP, lure domains, sample hash, registry persistence value).
Update history for TL-2026-2006
- 2026-08-17 — HACKERAI C2 Agent Abuses GitHub Gists for Command-and-Control; PATCHCORD and SHEETCORD Implants Linked to APT36: What changed No severity/exploitability/status change (remains HIGH/ACTIVE/ACTIVE, MEDIUM attribution). Report adds a specific PATCHCORD first-observed date, additional installer hashes/filenames, and expanded C2/lure infrastructure. New in
- 2026-08-16 — APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2 Against Afghan Telecom and South Asian Infrastructure: What changed No field escalations — severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution confidence (MEDIUM) are unchanged and consistent across both reports. New indicators (12) 12 new technical IOCs: primary C2 domai
Sources cited for PATCHCORD, SHEETCORD & HACKERAI C2 Agent
- PATCHCORD: New Malware Cluster Targets Afghan Telecom and South Asian Critical Infrastructure
- Acronis Researchers Uncover Three Previously Undocumented Malware Families Targeting Afghan Telecom And South Asian Infrastructure
- Transparent Tribe (G0134)
- SHEETCREEP, FIREPOWER, and MAILCREEP Analysis | ThreatLabz
- APT36: A Nightmare of Vibeware
- CVE-2024-6387 Detail
- dobin/antnium: A C2 framework for initial access in Go
- Researchers Uncovered SuperShell Payloads & Multiple Tools From Hacker's Open Directories
Threats related to PATCHCORD, SHEETCORD & HACKERAI C2 Agent
Detection coverage for TL-2026-2006
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2006 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.