Acronis Threat Research Unit published research this week documenting three previously undisclosed malware families operating from shared attacker infrastructure against Afghan telecommunications providers and South Asian critical infrastructure. The campaign has been active since at least March 2026. Attribution overlaps with APT36, the Pakistan-linked threat actor also tracked as Transparent Tribe, assessed with moderate confidence based on targeting geography, malware construction, and infrastructure reuse.
This is the first public documentation of this malware cluster. All three components — PATCHCORD, SHEETCORD, and an unnamed GitHub-based C2 agent — operate from the same infrastructure, indicating coordinated campaign activity rather than opportunistic tooling.
Initial Access and Delivery
Entry relies on lures built around Afghan Telecom’s internal tooling. The primary delivery mechanism is a ZIP archive named “Telecom_TMS.zip” containing an Inno Setup installer, “TMS_AfghanTelecom.exe,” presented as a Transport Management System tool used by Afghan Telecom to track corporate vehicles. The lure is operationally plausible and sector-specific — a strong indicator of prior reconnaissance into the target organisation’s internal workflows.
The campaign additionally distributes fake VPN installers impersonating AFTEL, the Afghan national telecommunications provider. The dual approach suggests deliberate targeting of both technical staff who might install network management software and general employees who could be issued a corporate VPN client.
Malware Architecture
PATCHCORD is the primary implant: a compiled C/C++ backdoor providing persistent access, command execution, and file transfer. It beacons to a hardcoded C2 server at 46.30.188[.]13.
SHEETCORD is the operationally notable component. Using Google Sheets as a command-and-control channel allows malicious traffic to blend with legitimate enterprise communications. The attacker pushes commands as spreadsheet entries and retrieves results through the same API. Google service traffic is rarely blocked or subjected to deep packet inspection in most enterprise environments, making this a low-friction evasion approach.
The third component, tracked as the HACKERAI C2 Agent, operates on the same principle but routes communications through GitHub Gists. Both trusted-platform C2 mechanisms exploit the common security posture of whitelisting major cloud providers. The combination of SHEETCORD and the GitHub agent suggests a deliberate strategy to maintain C2 persistence even if primary infrastructure is disrupted.
Attribution and Strategic Context
APT36 (Transparent Tribe) has operated continuously since at least 2013, with a documented focus on Indian government, military, and diplomatic targets. This campaign extends that pattern to Afghan telecom providers while maintaining secondary interest in Indian government IT, energy, and defence-sector organisations.
The shift toward Afghan national telecom as a primary target carries strategic logic: penetrating a national carrier creates metadata visibility across communications that would otherwise require substantially more difficult collection approaches. This is consistent with Pakistan’s documented intelligence interest in Afghan communications infrastructure and is a pattern distinct from APT36’s historically India-centric focus.
Sectors at Risk
Telecommunications operators across Afghanistan and South Asia face the most direct exposure. Regional providers with peering relationships or shared vendor infrastructure connected to AFTEL should assess whether they have received similar lures.
Critical infrastructure in India — particularly energy, defence, and government IT — represents documented secondary targeting. The campaign’s interest in IT contractors extends potential exposure across the broader public-sector supply chain.
Recommended Actions
Monitor and restrict outbound connections to Google Sheets and GitHub Gists from endpoints without a legitimate operational requirement to reach those services, particularly on restricted or OT-adjacent networks where these connections are anomalous.
Implement application controls to prevent Inno Setup installers from executing in environments where end users should not be installing software. The delivery mechanism requires user execution; this is a preventable step in the kill chain.
Hunt for the known C2 IP 46.30.188[.]13 in firewall and proxy logs. Any connection to this address should be treated as a confirmed indicator of compromise requiring immediate investigation.
Apply YARA rules from the Acronis TRU report against endpoint telemetry. Rules covering PATCHCORD and SHEETCORD binaries are included in the full disclosure. The complete IOC set — file hashes, C2 addresses, and network signatures — is available in the Acronis research publication.