2026-08-17 · view entry permalink →
PATCHCORD, SHEETCORD and HACKERAI — one espionage cluster runs three different command-and-control channels, two of them inside Google Sheets and GitHub, and persists by rewriting the victim's browser shortcuts
Acronis Threat Research Unit has published an analysis of three previously undocumented implants that share one operator's infrastructure and one design idea: put the command-and-control channel somewhere the network already trusts (Acronis TRU, 2026-08-13). The named targeting is Afghan telecom providers and South Asian government, defence and energy organisations, reached through sector-specific lures — Inno Setup installers impersonating an Afghan Telecom service-management tool and VPN client, an archive themed on a second Afghan operator, and an installer and decoy document themed on Afghanistan's Ministry of Communications and Information Technology.
PATCHCORD, the C/C++ implant, is the baseline. It hides its console window, establishes persistence, fingerprints the host and enters a polling loop against a hardcoded server. Its persistence is the part worth reading twice: it enumerates .lnk files across five locations including the taskbar, Quick Launch, Start Menu and both desktop folders, resolves each shortcut's real target through the IShellLinkW and IPersistFile COM interfaces to confirm it points at a genuine Microsoft Edge, Google Chrome or Mozilla Firefox binary, backs the original up, then rewrites the shortcut to launch the implant with the real browser path passed as an argument — preserving the original icon so nothing looks changed. Clicking the browser runs the implant first, which then silently starts the real browser so the user notices nothing. Its most consequential command decodes and decrypts an operator-supplied payload, allocates memory with VirtualAlloc, flips it to PAGE_EXECUTE_READ with VirtualProtect and runs it via CreateThread; Acronis notes that "the shellcode itself is never written to disk, making this a fully in-memory execution chain that leaves minimal forensic artifacts on the victim's machine" (Acronis TRU, 2026-08-13).
SHEETCORD is the Go successor and the reason this cluster matters outside its own region. Rather than calling a server the operator has to keep alive, it authenticates to the Google Sheets API v4 with a hardcoded cloud service-account credential embedded in the binary and creates a per-victim tab in the operator's spreadsheet for two-way tasking and results — a design Acronis says is "consistent with the documented SHEETCREEP implant" it references from prior research (Acronis TRU, 2026-08-13). It also diverges from PATCHCORD in ways that matter for detection: it runs commands through powershell -Command with script-block wrapping instead of cmd.exe /c, collects markedly less host information, widens the shortcut hijack from three browsers to six by adding Brave, Opera and Vivaldi, and generates a temporary VBScript to rewrite those shortcuts rather than using COM. It adds a persistence layer PATCHCORD lacks — a VBScript dropped into the user's Startup folder that launches the implant with a hidden window at every logon, plus a matching HKCU Run key written by shelling out to reg.exe. The third family, HACKERAI C2 Agent, was distributed from the cluster's earliest domain and shares the fingerprinting, remote-execution and shortcut-hijacking behaviour, but moves its tasking and exfiltration into GitHub Gists — a third distinct channel across one operator's toolset (Acronis TRU, 2026-08-13).
A different PATCHCORD variant appears in what Acronis calls an earlier campaign, observed in March 2026 against India's energy sector behind a fuel-conservation-client lure, and it carries an anti-analysis suite the Afghan-telecom sample does not: checks for VirtualBox and VMware device handles, a floor on processor count and installed memory, both IsDebuggerPresent and the PEB debug flag, a scan of active TCP connections for ports associated with intercepting proxies, a process-name check against a hardcoded list of analysis tools, and cursor-movement monitoring — falling into a randomised 30-to-90-second sleep when any check fires, which Acronis describes as designed to exhaust sandbox timeouts without the process termination that would itself be suspicious. On attribution Acronis is careful, and this entry keeps its wording: it "assesses with moderate confidence that the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor", resting on sustained Afghan telecom and government targeting, a browser-credential harvesting tool previously seen in APT36 operations, a C2 framework independently documented as part of that group's toolkit, and the Google Sheets channel's resemblance to earlier work attributed at medium confidence to the same cluster (Acronis TRU, 2026-08-13). Where an infrastructure fingerprint matched tooling previously attributed to a different, China-nexus operation, Acronis states that "these observations alone are insufficient to support an attribution" and does not carry the link forward (Acronis TRU, 2026-08-13).
Triage: browser shortcuts are legitimately rewritten by installers, enterprise deployment tooling and the browsers' own updaters, so a changed .lnk is not the signal on its own. The discriminator the mechanism supplies is that a hijacked shortcut points at a non-browser executable while carrying the real browser path as an argument and keeping the original icon, and that a .backup copy of the original sits next to it — an updater rewrites the target in place and leaves neither. Likewise, scripted Google Sheets access is ordinary in an organisation that automates reporting; what is not ordinary is a workstation or server authenticating to the Sheets API with a service-account credential that does not belong to any provisioned integration.
TRU assesses with moderate confidence that the activity overlaps with the broader APT36 (Transparent Tribe) cluster or a closely related Pakistan-linked threat actor based on targeting, malware similarities, infrastructure and operational tradecraft.
The SHEETCORD implant uses the Google Sheets API v4 with a hardcoded GCP service account for authentication and creates per-victim tabs in the operator's spreadsheet for bidirectional communication, all of which are consistent with the documented SHEETCREEP implant.
the shellcode itself is never written to disk, making this a fully in-memory execution chain that leaves minimal forensic artifacts on the victim's machine.
these observations alone are insufficient to support an attribution