APT36 Linked to PATCHCORD Espionage Using Google Sheets for Control

Researchers at Acronis have documented an espionage operation known as PATCHCORD, which is targeting Afghan telecom providers and critical infrastructure in South Asia. This operation utilizes a custom backdoor delivered through fake VPN installers and management tools that closely mimic legitimate software. The report from Acronis's Threat Research Unit highlights the sophistication of the campaign, noting that the malware is designed to blend in seamlessly with normal user activity.

The PATCHCORD backdoor is delivered via sector-specific lures, including installers that impersonate Afghan Telecom. These installers are crafted with meticulous detail, replicating the company name and product fields, as well as the URL of the actual support portal. Once a user clicks on the installer, a 64-bit Windows implant is quietly installed while a legitimate browser session opens in the background, making the infection nearly undetectable.

A notable feature of PATCHCORD is its method of establishing persistence. Instead of relying solely on registry modifications, it hijacks the shortcut files for popular web browsers like Edge, Chrome, and Firefox. This allows the malware to execute every time the browser is launched, running invisibly in the background.

Once installed, PATCHCORD connects to its command server and awaits further instructions. It supports several capabilities, including adjusting its communication frequency, listing running processes, executing shellcode in memory, and controlling its persistence remotely. The in-memory execution feature is particularly significant, as it minimizes the chances of detection by forensic investigators.

The investigation also uncovered a second implant named SHEETCORD, which is written in Go and uses the Google Sheets API for command and control. This method allows the malware to send and receive instructions through dedicated spreadsheet tabs, camouflaging malicious activity within normal corporate traffic.

Additionally, researchers identified a third malware family, HACKERAI C2 Agent, which utilizes GitHub Gists for similar purposes and shows signs of being developed with AI coding assistance. This suggests that threat actors are increasingly leveraging generative AI tools in their operations.

The investigation was significantly aided by the discovery of an exposed staging server, which contained a wealth of information about the operator's toolkit, including various remote access trojans and credential-harvesting tools. This exposure has provided clearer insights into the campaign's development and operational practices.

Acronis has linked this activity to APT36, also known as Transparent Tribe, a group known for targeting Indian government and defense organizations. While the connection is rated with moderate confidence, the evidence includes matching tools and techniques previously associated with APT36 campaigns.

The infrastructure used in this operation was still active at the time of publication, with domains rotating while the underlying server remained unchanged for months. Organizations involved with Afghan telecom operations or South Asian energy infrastructure should be particularly vigilant, as the sophistication of the lures used in this campaign indicates that traditional phishing awareness training may not suffice to protect against such threats. The PATCHCORD campaign exemplifies an evolving espionage effort targeting critical sectors across South Asia, highlighting the need for enhanced cybersecurity measures.