Introduction Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's National Informatics Centre (NIC). The campaign's infrastructure centers on a single C2 server with multiple associated domains, including domains impersonating Afghan telecom operators and a hijacked legitimate healthcare domain. An exposed staging server revealed the operator's broader toolkit, including SuperShell C2 framework, multiple RAT frameworks, credential harvesting tools, and exploit tooling for CVE-2024-6387 (regreSSHion). This research details TRU's analysis of the PATCHCORD, SHEETCORD and HACKERAI C2 Agent malware families, their C2 mechanisms and the supporting infrastructure. TRU assesses with moderate confidence that the campaign overlaps with the APT36 ( Transparent Tribe ) cluster based on targeting patterns, malware similarities, shared infrastructure, and operational tradecraft. The campaign reflects an evolution of Transparent Tribe's recent operations. While the group has historically focused on government, military and diplomatic organizations in India and the broader South Asian region, our investigation identified a stronger operational focus on Afghan telecom providers alongside government, defense and energy organizations. Combined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for C2, the campaign demonstrates continued evolution in both the group's targeting priorities and operational tradecraft. Telecom providers remain particularly attractive targets for espionage actors because they provide access to communications infrastructure, subscriber information and government communications, enabling intelligence collection that extends well beyond a single organization. Technical details Initial analysis and delivery mechanism The investigation began with the discovery of a suspicious ZIP archive, Telecom_TMS, on VirusTotal in June 2026. The archive contained a malicious Inno Setup installer, TMS_AfghanTelecom.exe, which delivered the PATCHCORD implant. The installer is a 32-bit Inno Setup (v6.7.0) executable compiled with Embarcadero Delphi 12.0 and protected with .NET Reactor. Afghan Telecom–themed installer metadata The Inno Setup installer contains version metadata designed to impersonate Afghan Telecom, with the CompanyName, FileDescription, and ProductName fields set to "Afghan Telecom," "TMS Afghan Telecom Setup," and "TMS Afghan Telecom," respectively (version 1.0.24). Button Button Embedded TMS_Launcher overlay Button Button Afghan Telecom TMS request portal The installer contains an overlay at offset 0x00136200 holding the Inno Setup virtual file system, including a single embedded executable, TMS_Launcher.exe (147 KB), alongside the standard installer metadata and uninstaller module. The installer further reinforces the Afghan Telecom impersonation through its application metadata. The AppPublisher field is set to "Afghan Telecom", while AppPublisherUrl points to hxxps[:]//tms[.]afghantelecom[.]af, the legitimate Afghan Telecom portal used for tracking service requests. This suggests the threat actor was familiar with the organization's infrastructure and deliberately crafted the installer to appear legitimate to Afghan Telecom employees. During installation, TMS_Launcher.exe is extracted and executed as the primary payload, which we track as PATCHCORD. PATCHCORD implant The extracted TMS_Launcher.exe is a 64-bit Windows executable compiled with the Microsoft Visual C/C++ (MSVC) toolchain and serves as the primary PATCHCORD implant. Button Button PATCHCORD main execution flow Following initialization, PATCHCORD hides its console window, establishes persistence through browser shortcut hijacking, fingerprints the host, registers with its C2 server and enters its main tasking loop. Button Button Microsoft Edge path argument and browser-launch thread PATCHCORD operates in two execution modes. When launched through a hijacked browser shortcut, it transparently starts the legitimate browser before continuing execution in the background, preserving the expected user experience while maintaining persistence. Otherwise, it proceeds directly to its primary functionality. Button Button BeaconBrowserHijack Registry Run Key The implant then checks for a registry value named BeaconBrowserHijack under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. If the value already exists, it skips ...