PATCHCORD

malware · malware:patchcord single-source

Compiled C/C++ Windows backdoor delivered through Inno Setup installers impersonating Afghan Telecom service-management and VPN software and Afghanistan's Ministry of Communications and Information Technology. It persists by rewriting Microsoft Edge, Google Chrome and Mozilla Firefox shortcuts across five locations to launch itself with the real browser path as an argument while preserving the original icon, fingerprints the host, and polls a hardcoded server. Its most consequential command decodes an operator-supplied payload and executes it entirely in memory via VirtualAlloc, VirtualProtect and CreateThread, writing nothing to disk. A different variant, used in what Acronis calls an earlier campaign against India's energy sector in March 2026, carries virtual-machine, debugger, analysis-process and user-input checks that trigger a randomised sleep rather than process termination (Acronis TRU, 2026-08-13).

Coverage

first 2026-08-17 → last 2026-08-17

Latest activity

2026-08-17

Espionage implants run command-and-control through the Google Sheets API and persist by rewriting browser…

Peak priority

notable

1 notable

Targets

telco

sectors: telco, energy, public-sector · regions: apac

Sources cited

3 hosts

Defender insights

What each entry about PATCHCORD tells a defender to do, newest first.

2026-08-17NOTABLEEspionage implants run command-and-control through the Google Sheets API and persist by rewriting browser shortcuts

Defender takeaway

The transferable half is the channel, not the victim list. An implant that authenticates to the Google Sheets API with an embedded service account and reads its tasking out of a spreadsheet cell produces egress that terminates on a Google-owned API endpoint, survives domain blocklists and reputation scoring, and looks in flow records like ordinary SaaS traffic; the GitHub Gist variant has the same property against a developer-tooling destination. The observable is the caller, not the destination: in proxy and egress telemetry, a host reaching sheets.googleapis.com or Gist endpoints with no browser session, no signed-in Workspace user and no sanctioned automation behind it is the anomaly, and server-class hosts with no developer function are where that reads cleanest. On the endpoint, three artifact classes carry the cluster: browser shortcut files whose target no longer points at the browser binary but passes it as an argument (with a .backup copy of the original left alongside), Startup-folder script drops and HKCU Run values created by reg.exe rather than by an installer, and the VirtualAlloc → VirtualProtect(PAGE_EXECUTE_READ) → CreateThread sequence in API telemetry, which is the only trace the in-memory payload leaves because nothing reaches disk.

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

overlaps with

APT36
actoractor:apt36evidence · 2026-08-17
Acronis TRU assesses at moderate confidence that the activity overlaps with the APT36 cluster or a closely related Pakistan-linked actor; the lab states an overlap, not an attribution
HACKERAI C2 Agent
malwaremalware:hackerai-c2-agentevidence · 2026-08-17
Acronis states HACKERAI C2 Agent shares multiple capabilities with PATCHCORD and SHEETCORD, differing in its command-and-control transport
SHEETCORD
malwaremalware:sheetcordevidence · 2026-08-17
Acronis records SHEETCORD as combining functionality previously observed in the SHEETCREEP RAT with capabilities introduced in PATCHCORD, on shared operator infrastructure

Story timeline

2026-08-17PATCHCORD, SHEETCORD and HACKERAI; one espionage cluster runs three different command-and-control channels, two of them inside Google Sheets and GitHub, and persists by rewriting the victim's browser shortcuts
active-threatsEspionage implants run command-and-control through the Google Sheets API and persist by rewriting browser shortcuts

Hunting pivots

Execution TA0002

T1059.001Command and Scripting Interpreter: PowerShell×1

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

Persistence TA0003

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1547.009Boot or Logon Autostart Execution: Shortcut Modification×1

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

Privilege Escalation TA0004

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1547.009Boot or Logon Autostart Execution: Shortcut Modification×1

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

Stealth TA0005

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1497Virtualization/Sandbox Evasion×1

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1564.003Hide Artifacts: Hidden Window×1

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

Discovery TA0007

T1057Process Discovery×1

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1082System Information Discovery×1

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1497Virtualization/Sandbox Evasion×1

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack · ATT&CK page ↗

Entries about PATCHCORD (1)

2026-08-17 · view entry permalink →

NOTABLENATOB2

PATCHCORD, SHEETCORD and HACKERAI; one espionage cluster runs three different command-and-control channels, two of them inside Google Sheets and GitHub, and persists by rewriting the victim's browser shortcuts

Acronis Threat Research Unit has published an analysis of three previously undocumented implants that share one operator's infrastructure and one design idea: put the command-and-control channel somewhere the network already trusts (Acronis TRU, 2026-08-13). The named targeting is Afghan telecom providers and South Asian government, defence and energy organisations, reached through sector-specific lures, Inno Setup installers impersonating an Afghan Telecom service-management tool and VPN client, an archive themed on a second Afghan operator, and an installer and decoy document themed on Afghanistan's Ministry of Communications and Information Technology.

PATCHCORD, the C/C++ implant, is the baseline. It hides its console window, establishes persistence, fingerprints the host and enters a polling loop against a hardcoded server. Its persistence is the part worth reading twice: it enumerates .lnk files across five locations including the taskbar, Quick Launch, Start Menu and both desktop folders, resolves each shortcut's real target through the IShellLinkW and IPersistFile COM interfaces to confirm it points at a genuine Microsoft Edge, Google Chrome or Mozilla Firefox binary, backs the original up, then rewrites the shortcut to launch the implant with the real browser path passed as an argument, preserving the original icon so nothing looks changed. Clicking the browser runs the implant first, which then silently starts the real browser so the user notices nothing. Its most consequential command decodes and decrypts an operator-supplied payload, allocates memory with VirtualAlloc, flips it to PAGE_EXECUTE_READ with VirtualProtect and runs it via CreateThread; Acronis notes that "the shellcode itself is never written to disk, making this a fully in-memory execution chain that leaves minimal forensic artifacts on the victim's machine" (Acronis TRU, 2026-08-13).

SHEETCORD is the Go successor and the reason this cluster matters outside its own region. Rather than calling a server the operator has to keep alive, it authenticates to the Google Sheets API v4 with a hardcoded cloud service-account credential embedded in the binary and creates a per-victim tab in the operator's spreadsheet for two-way tasking and results; a design Acronis says is "consistent with the documented SHEETCREEP implant" it references from prior research (Acronis TRU, 2026-08-13). It also diverges from PATCHCORD in ways that matter for detection: it runs commands through powershell -Command with script-block wrapping instead of cmd.exe /c, collects markedly less host information, widens the shortcut hijack from three browsers to six by adding Brave, Opera and Vivaldi, and generates a temporary VBScript to rewrite those shortcuts rather than using COM. It adds a persistence layer PATCHCORD lacks, a VBScript dropped into the user's Startup folder that launches the implant with a hidden window at every logon, plus a matching HKCU Run key written by shelling out to reg.exe. The third family, HACKERAI C2 Agent, was distributed from the cluster's earliest domain and shares the fingerprinting, remote-execution and shortcut-hijacking behaviour, but moves its tasking and exfiltration into GitHub Gists, a third distinct channel across one operator's toolset (Acronis TRU, 2026-08-13).

A different PATCHCORD variant appears in what Acronis calls an earlier campaign, observed in March 2026 against India's energy sector behind a fuel-conservation-client lure, and it carries an anti-analysis suite the Afghan-telecom sample does not: checks for VirtualBox and VMware device handles, a floor on processor count and installed memory, both IsDebuggerPresent and the PEB debug flag, a scan of active TCP connections for ports associated with intercepting proxies, a process-name check against a hardcoded list of analysis tools, and cursor-movement monitoring, falling into a randomised 30-to-90-second sleep when any check fires, which Acronis describes as designed to exhaust sandbox timeouts without the process termination that would itself be suspicious. On attribution Acronis is careful, and this entry keeps its wording: it "assesses with moderate confidence that the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor", resting on sustained Afghan telecom and government targeting, a browser-credential harvesting tool previously seen in APT36 operations, a C2 framework independently documented as part of that group's toolkit, and the Google Sheets channel's resemblance to earlier work attributed at medium confidence to the same cluster (Acronis TRU, 2026-08-13). Where an infrastructure fingerprint matched tooling previously attributed to a different, China-nexus operation, Acronis states that "these observations alone are insufficient to support an attribution" and does not carry the link forward (Acronis TRU, 2026-08-13).

Defender takeaway

Triage: browser shortcuts are legitimately rewritten by installers, enterprise deployment tooling and the browsers' own updaters, so a changed .lnk is not the signal on its own. The discriminator the mechanism supplies is that a hijacked shortcut points at a non-browser executable while carrying the real browser path as an argument and keeping the original icon, and that a .backup copy of the original sits next to it; an updater rewrites the target in place and leaves neither. Likewise, scripted Google Sheets access is ordinary in an organisation that automates reporting; what is not ordinary is a workstation or server authenticating to the Sheets API with a service-account credential that does not belong to any provisioned integration.

TRU assesses with moderate confidence that the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor based on targeting, malware similarities, infrastructure and operational tradecraft.

The SHEETCORD implant uses the Google Sheets API v4 with a hardcoded GCP service account for authentication and creates per-victim tabs in the operator's spreadsheet for bidirectional communication, all of which are consistent with the documented SHEETCREEP implant.

the shellcode itself is never written to disk, making this a fully in-memory execution chain that leaves minimal forensic artifacts on the victim's machine.

these observations alone are insufficient to support an attribution

Acronis Threat Research Unit 2026-08-13

threat17 Aug 04:28Zsingle-sourceOpen finding →

Sources: Acronis Threat Research Unit · The Hacker News · Security Affairs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

APT36×1
actoractor:apt36linked
HACKERAI C2 Agent×1
malwaremalware:hackerai-c2-agentlinked
SHEETCORD×1
malwaremalware:sheetcordlinked

Where this entity is cited

Threats1

Source distribution

acronis.com1 (33%)
securityaffairs.com1 (33%)
thehackernews.com1 (33%)

All cited sources (3)