A newly discovered espionage campaign, dubbed PATCHCORD, has been observed targeting Afghan telecommunications providers and critical infrastructure organizations in South Asia. Security researchers at Acronis identified a custom C/C++ backdoor, PATCHCORD, being delivered through highly specific lures, including fake VPN installers designed to impersonate legitimate tools from Afghan Telecom (AFTEL) and other telecom management utilities.
The attackers demonstrated a sophisticated understanding of their targets, with one fake installer matching the company name, product fields, and even the support portal URL of Afghan Telecom. When executed, these installers quietly deploy the 64-bit Windows implant while simultaneously opening a genuine browser session in the background, making the infection appear seamless to the user.
PATCHCORD establishes persistence by hijacking browser shortcuts for Microsoft Edge, Google Chrome, and Mozilla Firefox. It first checks for elevated privileges, then backs up the original shortcut files and rewrites them to launch the malware before the legitimate browser. This ensures that every time a user clicks their browser icon, the malware runs invisibly in the background.
Once installed, PATCHCORD communicates with its command and control (C2) server and supports five primary functions: adjusting its check-in frequency, listing running processes, executing shellcode entirely in memory, running arbitrary commands via a hidden shell, and remotely controlling its browser-hijacking persistence mechanism. The in-memory shellcode execution is particularly notable as it minimizes forensic evidence on disk.
Further investigation into the campaign's infrastructure led researchers to a more advanced, Go-based implant named SHEETCORD. This malware, distributed through a domain impersonating India's National Informatics Centre (NIC), builds upon PATCHCORD's capabilities and abuses the Google Sheets API for C2 communications. SHEETCORD creates a dedicated spreadsheet tab for each victim to send and receive instructions, a technique that allows malicious traffic to blend in with normal corporate network activity. Its command execution capability uses `powershell -Command` with script block wrapping, an evolution from PATCHCORD's `cmd.exe /c` approach.
Researchers also uncovered a third malware family, the HACKERAI C2 Agent, which utilizes GitHub Gists for C2. This agent exhibits characteristics consistent with AI-assisted code generation, including debug messages, AI-style code comments, and a redundant double-XOR routine using the same key. This suggests that the threat actors are employing large language models (LLMs) as ordinary coding shortcuts.
A significant breakthrough in the investigation was the discovery of an unsecured staging server left exposed by the operator. This server contained the full toolkit used by the threat actor, including SuperShell, a Chinese-language C2 framework, multiple remote access trojan frameworks, credential-harvesting tools, exploit code for a known OpenSSH vulnerability, and files formatted like iOS call history databases, indicating potential mobile device data exfiltration.
While Acronis has not definitively attributed the campaign, the sophistication of the tooling and targeting aligns with known tactics of advanced persistent threat (APT) groups. The specific targeting of Afghan telecom and South Asian critical infrastructure suggests a state-sponsored espionage motive.
