Afghan telecommunications providers and critical infrastructure entities in South Asia are currently facing a sophisticated cyber espionage campaign deploying a newly identified backdoor named PATCHCORD. This malware, written in C/C++, is disseminated through sector-specific lures, notably counterfeit VPN installers masquerading as Afghan Telecom (AFTEL) and telecom management tools.
Further investigation into the attackers’ infrastructure has unveiled another backdoor, SHEETCORD, developed in Go. This variant utilizes Google Sheets for command-and-control (C2) communications and is distributed via a domain impersonating India’s National Informatics Center (NIC).
The campaign’s infrastructure revolves around a central C2 server linked to multiple domains, including those mimicking Afghan telecom operators and a compromised legitimate healthcare domain. Analysis suggests that this operation is likely orchestrated by APT36, also known as Transparent Tribe, a threat actor with alleged ties to Pakistan. This assessment is based on overlapping targeting patterns, malware similarities, shared infrastructure, and consistent operational methods.
The attack initiates with a ZIP archive named “Telecom_TMS.zip,” containing an Inno Setup installer titled “TMS_AfghanTelecom.exe.” This installer delivers the PATCHCORD backdoor. Notably, “TMS” refers to the Transport Management System, an internal platform used by Afghan Telecom to manage corporate vehicle and transport requests.
Upon execution, PATCHCORD conceals its console window and establishes persistence by hijacking browser shortcuts for Google Chrome, Microsoft Edge, and Mozilla Firefox, provided it has the necessary elevated privileges. The malware then fingerprints the host system and registers with its C2 server at 46.30.188[.]13 to receive commands. These commands enable the backdoor to:
- Adjust the C2 beacon interval
- Enumerate all running processes
- Decode and execute shellcode payloads received from the C2 server in memory
- Execute arbitrary commands via “cmd.exe”
- Manage the browser shortcut hijacking persistence mechanism interactively
When launched through a hijacked browser shortcut, PATCHCORD transparently starts the legitimate browser, maintaining the expected user experience while operating covertly in the background. If executed directly, it proceeds with its primary functions without initiating the browser.
The malware checks for a Windows Registry value named “BeaconBrowserHijack” under “HKCU\Software\Microsoft\Windows\CurrentVersion\Run.” If this value exists, it assumes the system is already compromised and skips the shortcut hijacking process. Otherwise, it writes its executable path to this registry key, ensuring persistence across reboots and activating the browser shortcut hijacking routine upon user login.
Further scrutiny of the threat actor’s infrastructure has revealed a campaign targeting Indian government IT networks. This includes a counterfeit website mimicking NIC (“nic-support[.]site”) used to deploy SHEETCORD. This backdoor combines functionalities from both SHEETCREEP and PATCHCORD, implementing remote command execution via PowerShell instead of “cmd.exe,” gathering basic host information, and establishing persistence through the Windows Startup folder using a Visual Basic Script. Additionally, it incorporates PATCHCORD’s browser shortcut hijacking mechanism, extending its reach to browsers like Brave.
These developments underscore the evolving tactics of cyber espionage groups targeting critical infrastructure in South Asia. Organizations in the region must remain vigilant, implementing robust cybersecurity measures and educating personnel about the risks associated with phishing and social engineering attacks. The use of legitimate-looking lures and advanced persistence mechanisms highlights the need for comprehensive security strategies to detect and mitigate such sophisticated threats.
