Full Report
Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit (TRU), the backdoor is a compiled C/C++ implant delivered by means of sector-specific lures, including fake VPN installers impersonating Afghan Telecom (
Analysis Summary
# Tool/Technique: PATCHCORD & SHEETCORD
## Overview
**PATCHCORD** is a previously undocumented C/C++ compiled backdoor used in cyber espionage campaigns targeting telecommunications and critical infrastructure in Afghanistan and South Asia. A secondary variant, **SHEETCORD**, is a Go-based backdoor that leverages Google Sheets for Command-and-Control (C2) communication. These tools are primarily used to maintain long-term access and execute arbitrary code on compromised systems.
## Technical Details
- **Type:** Malware family (Backdoor)
- **Platform:** Windows
- **Capabilities:** Persistence via shortcut hijacking, shellcode execution, process enumeration, and remote command execution.
- **First Seen:** March 2024 (Note: Article date states 2026, indicating a future-dated report or typo in the source; likely 2024).
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- [T1546.009 - Event Triggered Execution: Shortcut Modification]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- [T1140 - Deobfuscate/Decode Files or Information]
- **[TA0007 - Discovery]**
- [T1057 - Process Discovery]
- [T1082 - System Information Discovery]
- **[TA0011 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication (Google Sheets)]
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **C2 Beaconing:** Adjustable check-in intervals to communicate with hardcoded or dynamic C2 infrastructure.
- **System Fingerprinting:** Gathers basic host information and enumerates all running processes.
- **Remote Execution:** Executes arbitrary commands via `cmd.exe` (PATCHCORD) or PowerShell (SHEETCORD).
- **Payload Deployment:** Capable of receiving, decoding, and executing shellcode directly in memory.
### Advanced Features
- **Browser Shortcut Hijacking:** Modifies shortcuts for Chrome, Edge, Firefox, Brave, Opera, and Vivaldi. When a user clicks the browser icon, the malware launches and then starts the legitimate browser to avoid suspicion.
- **Stealth Persistence:** Checks for specific registry values (e.g., `BeaconBrowserHijack`) to avoid redundant infection and hides its console window upon execution.
- **Anti-Analysis:** Some variants include anti-debugging and anti-analysis checks specifically used in attacks against the Indian energy sector.
## Indicators of Compromise
- **File Hashes:**
- *Note: Specific MD5/SHA256 hashes were not provided in the snippet; researchers refer to `TMS_AfghanTelecom.exe`.*
- **File Names:**
- `Telecom_TMS.zip`
- `TMS_AfghanTelecom.exe`
- **Registry Keys:**
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BeaconBrowserHijack`
- **Network Indicators:**
- `46.30.188[.]13` (PATCHCORD C2)
- `nic-support[.]site` (SHEETCORD Delivery)
- `tms.afghantelecom[.]af` (Impersonated domain)
- **Behavioral Indicators:**
- Modification of `.lnk` files in the user's Desktop or Taskbar folders.
- Unexpected PowerShell or CMD processes spawned by hijacked browser shortcuts.
## Associated Threat Actors
- **APT36 (Transparent Tribe):** A Pakistan-aligned threat group. The attribution is based on overlaps in infrastructure, targeting of South Asian government/critical infrastructure, and use of similar Go-based malware.
## Detection Methods
- **Signature-based:** Monitor for Inno Setup installers with filenames mimicking Afghan Telecom or Indian NIC services.
- **Behavioral:**
- Detect modification of browser shortcut targets (`.lnk` files).
- Monitor for registry writes to the `Run` key involving non-standard executable paths.
- Identify Go-based binaries communicating with `sheets.googleapis.com`.
- **YARA:** Rules focusing on the unique string "BeaconBrowserHijack" or the specific implementation of the browser hijacking routine in C++.
## Mitigation Strategies
- **Shortcut Integrity:** Implement File Integrity Monitoring (FIM) on common shortcut locations (Desktop, Start Menu, Taskbar).
- **Application Whitelisting:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unverified Inno Setup installers.
- **Hardening:** Disable PowerShell/CMD execution for standard users where not required for business functions.
- **User Training:** Educate employees on verifying the source of VPN and Transport Management software.
## Related Tools/Techniques
- **SHEETCREEP:** An older Go-based malware also used by APT36 that utilizes Google Sheets for C2.
- **Antnium:** An open-source C2 framework found on associated staging servers.