New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Summary: Acronis Threat Research Unit researchers attribute an ongoing campaign delivering a new C/C++ backdoor called PATCHCORD to the Pakistan-aligned APT36 (Transparent Tribe) with moderate confidence, citing overlaps in targeting, malware, infrastructure, and tradecraft. The campaign uses fake VPN installers impersonating Afghan Telecom and a domain impersonating India's National Informatics Center to deliver PATCHCORD and a Go-based backdoor called SHEETCORD that uses Google Sheets for command-and-control, with PATCHCORD in use since at least March 2026 and one attack targeting India's energy sector.
What's compelling: The group's infrastructure runs through a single C2 server at 46.30.188[.]13 and abuses legitimate services like Google Sheets and GitHub Gists for command-and-control, so blocking known-bad domains and watching for unusual API traffic are the controls that matter here. An exposed staging server also revealed exploits for CVE-2024-6387 and open-source C2 frameworks, meaning the toolkit is broader than the two backdoors described.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-6387
- Related
- Storm⚡Watch: Unplugged - July 9th, 2024 Cyber Risks ·