The activity uses three previously undocumented malware families PATCHCORD, SHEETCORD, and HACKERAI C2 Agent and shows possible links to APT36, also known as Transparent Tribe.
Researchers assess the attribution with moderate confidence. The assessment is based on the group’s targeting patterns, shared infrastructure, malware similarities, and tools found on an exposed staging server.
The campaign primarily targets telecom, government, defense, and energy organizations in Afghanistan and India.
Telecom companies are high-value targets because attackers can potentially access communications systems, subscriber data, and sensitive government-related information.
The campaign shows that the operators are expanding beyond traditional government and military espionage targets.
APT36 HackerAI LLM-Assisted Implant
The investigation began after researchers found a suspicious ZIP archive named Telecom_TMS on VirusTotal in June 2026.
It contained a malicious installer called TMS_AfghanTelecom.exe, designed to appear as a legitimate Afghan Telecom management tool.
The installer used Afghan Telecom branding in its file metadata and included the legitimate Afghan Telecom service-request portal in its publisher URL.
This social-engineering approach was likely intended to convince employees that the file was safe. After execution, the installer drops PATCHCORD, a custom 64-bit Windows backdoor written in C/C++.
The malware hides its console window, gathers information about the infected device, registers with its command-and-control server, and waits for attacker commands.
PATCHCORD achieves persistence by hijacking browser shortcuts for Microsoft Edge, Google Chrome, and Mozilla Firefox.
It changes a browser shortcut so that the malware launches first, then silently opens the real browser. The victim sees the expected browser window and may not notice the malicious activity running in the background.
The implant can enumerate running processes, execute commands through cmd.exe, change its beacon interval, and run shellcode directly in memory.
This in-memory execution avoids writing the final payload to disk, reducing visible forensic traces. PATCHCORD communicated with the domain appstoore[.]solutions over port 8080.
Researchers linked the domain to the IP address 46.30.188[.]13, which hosted several domains impersonating Afghan telecom services, Indian government entities, and other organizations.
Infrastructure analysis uncovered another active campaign using nic-support[.]site, a domain impersonating India’s National Informatics Centre.
The site distributed a fake Ministry of Defense update installer that deployed SHEETCORD, a Go-based malware implant.
SHEETCORD shares several functions with PATCHCORD, including remote command execution and browser shortcut hijacking.
However, it adds persistence through a VBScript in the Windows Startup folder and supports six browsers: Chrome, Firefox, Edge, Brave, Opera, and Vivaldi, Acronis said.
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| C2 Domain | appstoore[.]solutions | PATCHCORD hardcoded C2 domain over TCP/8080 |
| C2 IP | 46.30.188[.]13 | Shared campaign infrastructure |
| Malicious Domain | afghantelecom[.]site |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
