New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Acronis TRU revealed an active campaign by APT36 (Transparent Tribe) targeting Afghan telecommunications providers and critical infrastructure in India. The operation deploys two previously undocumented backdoors, PATCHCORD and SHEETCORD, using lures that impersonate the state-owned Afghan Telecom (AFTEL) and India's National Informatics Center (NIC). These implants establish persistence via browser shortcut hijacking and utilize unconventional C2 channels, including Google Sheets and GitHub Gists, while a staging server exposed open-source frameworks and the exploit for CVE-2024-6387.