PATCHCORD Cluster Targets South Asian Infrastructure

The APT36 espionage campaign is targeting Afghan telecom providers and South Asian critical infrastructure organizations with three previously undocumented backdoors, each delivered through lures tailored to the victim's sector. Afghan telecom targets receive fake VPN installers and a bogus telecom management tool impersonating Afghan Telecom, packaged inside ZIP archives carrying an Inno Setup installer crafted to look genuine, down to the publisher's name and a link to the real Afghan Telecom portal. Indian government targets are lured by a spoofed National Informatics Centre site that serves a fake employee-benefits update. In parallel, a staging server holds exploit tooling for CVE-2024-6387, the OpenSSH flaw known as regreSSHion, alongside brute-forcing utilities. This vulnerability is a signal-handler race condition in OpenSSH's server (sshd), a regression of an older 2006 bug, which can let an unauthenticated remote attacker who fails to complete login within the grace period execute code on the host; it carries a high-severity CVSS 8.1 rating. Its presence points to a second route in for APT36: breaking into internet-facing telecom and government systems to gain a network-level foothold before any endpoint implant is dropped.

Once the installer runs, it launches PATCHCORD, which hides its console window and establishes persistence by hijacking browser shortcuts, backing up each original and rewriting it so the implant runs first and then silently launches the real browser. PATCHCORD also writes its path to a registry Run key to survive reboots, fingerprints the host, registers with its server, and polls for commands. Tasking lets the operator adjust the check-in interval, list processes, run shell commands, and decode and run shellcode entirely in memory so nothing touches disk. The Go-based SHEETCORD extends the same shortcut hijacking to six browsers, runs commands through PowerShell, and adds a startup-folder script, while the AI-assisted HACKERAI C2 Agent reuses the same fingerprinting and persistence with its own channel.

To widen access, APT36 favors credential theft over noisy exploitation. The staging server held an open-source browser credential-harvesting tool tied to this actor's past operations, alongside brute-forcing artifacts, indicating it collects stored logins and hammers exposed services for valid credentials. The regreSSHion tooling signals intent to compromise network-facing infrastructure directly, opening movement into telecom and government environments beyond the initial endpoint. PATCHCORD also checks for elevated privileges before altering shortcuts, showing awareness of its privilege context.

For getting data out, each implant uses a different channel to blend into normal traffic. PATCHCORD encodes command output with a custom scheme and posts it to its own server over HTTP on a non-standard port. SHEETCORD reads and writes per-victim tabs in a Google spreadsheet, turning a legitimate cloud service into a two-way control and exfiltration path, while HACKERAI C2 Agent uses GitHub Gists with dedicated upload and download routines. Router and session backups and an apparent iOS call-history database recovered from the staging server suggest APT36 has also pulled data from network devices and mobile targets, not just Windows machines. Taken together, the focus on Afghan and Indian telecom, government, and defense entities, the SHEETCREEP-style Google Sheets C2, and toolkit overlaps such as GateSentinel and HackBrowserData point to APT36, also known as Transparent Tribe, a Pakistan-aligned espionage group assessed with moderate confidence to be behind the campaign.