# PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian Critical Infrastructure (APT36-linked)

> Acronis TRU identified three previously undocumented malware families — PATCHCORD (a C/C++ backdoor), SHEETCORD (a Go implant abusing the Google Sheets API for C2), and HACKERAI C2 Agent (a Go implant using GitHub Gists for C2, showing signs of AI-assisted development) — deployed in an active cyber-espionage campaign against Afghan Telecom (AFTEL), Afghanistan's Ministry of Communications and Information Technology, India's National Hydroelectric Power Corporation (NHPC), and Indian Ministry of Defence personnel. Acronis TRU attributes the campaign with moderate confidence to APT36 (Transparent Tribe), a suspected Pakistan-linked group active since at least 2013.

- **Published:** 2026-08-13T00:00:00Z
- **Last reviewed:** 2026-08-17T02:59:58.352Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2006
- **ID:** TL-2026-2006
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT36 (Pakistan)
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-6387

## Description

Acronis's Threat Research Unit (researchers Subhajeet Singha, Darrel Virtusio, and Santiago Pontiroli) traced the cluster back to a suspicious ZIP archive uploaded to VirusTotal in June 2026 that referenced Afghan Telecom (AFTEL), Afghanistan's state-owned telecom operator. Pulling the thread exposed a live attacker staging server and three distinct, previously undocumented implants sharing infrastructure and delivery lures.

PATCHCORD is a compiled C/C++ backdoor distributed via Inno Setup installers that impersonate AFTEL VPN clients and telecom-management utilities. It performs host fingerprinting, executes attacker commands via cmd.exe, and establishes persistence by hijacking browser shortcuts. SHEETCORD is a Go-language evolution of that capability that routes command-and-control through the Google Sheets API using a hardcoded GCP service-account credential, giving the operators bidirectional C2 that rides on legitimate, TLS-encrypted Google infrastructure; Acronis TRU found significant code and functionality overlap between SHEETCORD and the previously reported SHEETCREEP implant (a C# Google-Sheets backdoor attributed with medium confidence to APT36 or a related Pakistan-linked subgroup by Zscaler ThreatLabz). A live SHEETCORD lure used a domain spoofing India's National Informatics Centre (NIC) to serve an installer disguised as a "Ministry of Defense Employee Breach Update," targeting Indian Ministry of Defence and Air Force personnel. HACKERAI C2 Agent is a third Go implant, first observed in the wild in September 2025, that instead abuses GitHub Gists as its C2 channel; its code contains debugging artifacts, redundant/duplicated XOR routines, hardcoded credentials, and clear-text debug strings consistent with rapid, AI-assisted ("vibeware") development rather than hand-written tradecraft — a production style Bitdefender separately documented as an emerging APT36 pattern in March 2026.

All three implants share a persistence technique Acronis calls browser-shortcut hijacking: the malware backs up the target's existing .lnk shortcuts for Edge, Chrome, Firefox, Brave, Opera, and Vivaldi across the taskbar, Quick Launch, Start Menu, and desktop, then rewrites each shortcut to launch the implant first before silently chain-loading the legitimate browser, keeping the victim unaware. SHEETCORD additionally drops a VBScript loader into the Windows Startup folder as a secondary persistence path. Execution is largely in-memory/reflective, minimizing on-disk forensic artifacts.

The operators' staging server, still active and reachable at the time of research, hosted a large offensive toolkit alongside the three implants: Metasploit, the Chinese-language SuperShell C2 panel, the Go/C GateSentinel C2 framework (co-located directly with PATCHCORD campaign files), the open-source Go C2 framework Antnium, HackBrowserData (an open-source browser credential harvester previously linked to APT36 operations), a rockyou.txt-derived password list, a Nim-based backdoor, and working exploit tooling for CVE-2024-6387 ("regreSSHion"), the OpenSSH signal-handler race condition, apparently staged for scanning and exploiting internet-facing OpenSSH instances. The server also held artifacts suggesting a broader collection scope beyond the three Windows implants documented here — an iOS call-history database schema and router configuration-backup archives — indicating the actors may also target mobile devices and network appliances in related operations, though Acronis TRU could not confirm those capabilities are wired into PATCHCORD/SHEETCORD/HACKERAI specifically. C2 domains sat behind Let's Encrypt TLS certificates that were rotated three times, each rotation covering a different bundled set of lookalike domains (impersonating AFTEL, Salaam Telecom, Afghanistan's Ministry of Communications and IT, and India's NHPC and Controller General of Defence Accounts), consistent with deliberate infrastructure cycling to evade domain/certificate-based blocklists. Acronis also identified a secondary server geolocated to Guangdong, China, hosting artifacts associated with the unrelated ValleyRAT/SilverFox malware family; TRU assessed the overlap as infrastructure co-location rather than evidence of operational coordination between the two actors.

Acronis TRU attributes the cluster to APT36 (Transparent Tribe) with moderate confidence, citing: sustained targeting of Afghan telecom and South Asian government/defense infrastructure consistent with APT36's historical scope; the presence of HackBrowserData, previously observed in APT36 tooling; co-location of the GateSentinel C2 framework with PATCHCORD campaign files; and SHEETCORD's close technical overlap with the Google-Sheets-based SHEETCREEP implant already linked to the group. The campaign reflects a broader shift, also documented independently by Bitdefender and Zscaler, of APT36 subgroups adopting "living-off-trusted-services" C2 (Google Sheets, GitHub Gists, Firebase, Slack, Discord) and AI-accelerated malware production to blend traffic into legitimate SaaS usage and increase implant throughput.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.001 Domains
- T1587.003 Digital Certificates
- T1588.002 Tool
- T1566.002 Spearphishing Link
- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1547.009 Shortcut Modification
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1057 Process Discovery
- T1555.003 Credentials from Web Browsers
- T1602.002 Network Device Configuration Dump
- T1102.002 Bidirectional Communication
- T1583.006 Acquire Infrastructure
- T1587.001 Develop Capabilities
- T1566.001 Phishing
- T1059.001 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1622 Debugger Evasion
- T1005 Data from Local System
- T1071.001 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1588.005 Obtain Capability: Exploits

## Sources

- [PATCHCORD: New Malware Cluster Targets Afghan Telecom and South Asian Critical Infrastructure](https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/)
- [Acronis Researchers Uncover Three Previously Undocumented Malware Families Targeting Afghan Telecom And South Asian Infrastructure](https://smbtech.au/news/acronis-researchers-uncover-three-previously-undocumented-malware-families-targeting-afghan-telecom-and-south-asian-infrastructure/)
- [Transparent Tribe (G0134)](https://attack.mitre.org/groups/G0134/)
- [SHEETCREEP, FIREPOWER, and MAILCREEP Analysis | ThreatLabz](https://www.zscaler.com/blogs/security-research/apt-attacks-target-indian-government-using-sheetcreep-firepower-and)
- [APT36: A Nightmare of Vibeware](https://www.bitdefender.com/en-us/blog/businessinsights/apt36-nightmare-vibeware)
- [CVE-2024-6387 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-6387)
- [dobin/antnium: A C2 framework for initial access in Go](https://github.com/dobin/antnium)
- [Researchers Uncovered SuperShell Payloads & Multiple Tools From Hacker's Open Directories](https://cybersecuritynews.com/researchers-uncovered-supershell-payloads-multiple-tools/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2006