Acronis Threat Research Unit — Darrel Virtusio, Santiago Pontiroli and Subhajeet Singha — has documented PATCHCORD, a C/C++ implant deployed since at least March 2026 against Afghan Telecom and, more consequentially for readers here, Indian government IT networks including the National Informatics Centre, plus energy sector organisations in India.

Attribution is to APT36 (Transparent Tribe), a Pakistan-aligned group, at moderate confidence — based on overlapping targeting, malware similarities, shared infrastructure and tradecraft.

Moderate confidence is the analyst's way of saying the pattern fits and nothing proves it. Worth carrying as stated rather than upgraded.

The persistence is the interesting part

Most Windows implants persist through a registry Run key, a scheduled task or a service. Defenders know all three and monitor them.

PATCHCORD hijacks browser shortcuts — Chrome, Edge and Firefox.

It rewrites the thing on your desktop and taskbar that you click twenty times a day. The browser still opens. Nothing looks wrong. The implant runs because you wanted to check your email.

That sidesteps the persistence detections most estates actually have, and it survives a reboot without touching anything an EDR is watching closely.

It also leaves a marker: PATCHCORD checks for a registry value named BeaconBrowserHijack to avoid reinfecting a machine it already owns. That string is the single most useful indicator in the report — it is unique, it is cheap to hunt for, and it is present on every compromised host.

What it does once running

  • Hides its console window on execution
  • Fingerprints the host
  • Takes tasking from C2, and can adjust its beacon interval
  • Enumerates running processes
  • Decodes and executes shellcode
  • Runs arbitrary commands through cmd.exe
  • Controls its own browser-hijack persistence

Adjustable beaconing matters for detection: an implant that can slow itself down defeats rules keyed to a fixed callback rhythm.

How it arrives

A ZIP containing an Inno Setup installer. The named example is Telecom_TMS.zip, holding TMS_AfghanTelecom.exe — impersonating Afghan Telecom's Transport Management System, the internal tool for tracking corporate vehicle requests.

That is a precise lure. Not a generic invoice, not a fake update: an internal logistics application that employees of one specific state telecom would recognise and expect. Somebody did the homework.

Two siblings, and a staging server left open

Acronis found two related families:

SHEETCORD — a Go backdoor using Google Sheets for command and control, combining functionality from SHEETCREEP and PATCHCORD, adding PowerShell execution, and extending browser targeting to Brave, Opera and Vivaldi.

HACKERAI C2 — uses GitHub Gists for C2, with dedicated upload and download.

Both pick a C2 channel that is a legitimate service. Blocking Google Sheets or GitHub across an enterprise is not an option, which is precisely why they were chosen — the same reasoning behind DeadLock putting its leak site on Polygon and Kimwolf resolving C2 through ENS.

An exposed staging server revealed the operator's toolkit: open-source C2 frameworks antnium, GateSentinel and SuperShell, exploits for CVE-2024-6387, and AI-assisted malware projects.

Indicators

  • C2: 46.30.188[.]13
  • Registry value: BeaconBrowserHijack
  • Domains impersonating Afghan telecom operators, plus hijacked legitimate healthcare domains

That last one deserves attention if you run a healthcare domain. Being used as attacker infrastructure does not require you to be the target.

What to do

  • Hunt for the BeaconBrowserHijack registry value. One string, high confidence, trivial to query across an estate.
  • Baseline your browser shortcut targets. A shortcut for Chrome whose target is not Chrome is the whole technique, and almost nobody checks.
  • Alert on Inno Setup installers arriving in ZIPs, particularly ones named after internal tools.
  • Treat Google Sheets and GitHub Gist traffic as a C2 channel worth profiling, not as trusted-by-default.
  • Patch CVE-2024-6387 if it is still open anywhere. The operator has an exploit for it.

What is not established

  • Victim counts. Not published.
  • Attribution beyond moderate confidence. Acronis does not claim more and neither do we.
  • What was taken. The report describes capability and infrastructure, not outcomes.