New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Back Thehackernews

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Thehackernews • August 13, 2026

Share: View original

AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.

AI is helping teams ship code 10–50× faster. This session shows how to keep security from falling behind.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PATCHCORD Malware Targets Afghan Telecom and South Asian Infrastructure Acronis Threat Research Unit has identified a new malware campaign named PATCHCORD, targeting Afghan telecom providers and critical infrastructure in South Asia. The malware, a custom backdoor written in C/C++, is delivered through fake VPN installers impersonating Afghan Telecom. The campaign also includes a Go-based implant, SHEETCORD, which utilizes Google Sheets for command and control communication. The malware was distributed via a domain mimicking India's National Informatics Centre. The campaign's infrastructure relies on a single command and control server with multiple domains, including hijacked healthcare domains. The investigation revealed a toolkit comprising various remote access tools, credential harvesting tools, and exploit tooling for CVE-2024-6387. TRU assesses with moderate confidence that this campaign is linked to the APT36 (Transparent Tribe) group, indicating an evolution in their targeting and operational tactics. The campaign reflects a shift towards Afghan telecom providers and critical sectors like government and energy. The investigation began after discovering a malicious ZIP archive on VirusTotal in June 2026. 10 sources 74

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)