Acronis researchers have uncovered a sophisticated espionage campaign involving a new backdoor named PATCHCORD, which is targeting Afghan telecom providers and critical infrastructure in South Asia through deceptive fake VPN tools. This campaign utilizes highly specific lures, including fake installers that impersonate legitimate companies like Afghan Telecom, as reported by Security Affairs.The PATCHCORD backdoor employs a stealthy persistence mechanism by hijacking browser shortcuts for Edge, Chrome, and Firefox, ensuring the malware runs before the intended application launches. Once active, it communicates with command and control (C2) servers, capable of listing processes, executing shellcode in memory, and running arbitrary commands. A more evolved implant, SHEETCORD, written in Go, has also been identified, which abuses Google Sheets for C2 communication, making malicious traffic harder to detect. A third malware family, HACKERAI C2 Agent, shows signs of AI-assisted development and uses GitHub Gists for C2.Acronis links this activity to APT36 (Transparent Tribe), a group known for targeting Indian government and defense entities. The discovery of an exposed staging server provided significant insight into the threat actor's toolkit, including C2 frameworks and credential-harvesting tools. The ongoing nature of the campaign, with active domains and persistent infrastructure, poses a significant risk to organizations in the telecom, government, and critical infrastructure sectors across South Asia.Source: Security Affairs
