PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Acronis Threat Research Unit (TRU) reports an active espionage campaign—tracked to APT36-like activity—targeting Afghan telecoms and South Asian critical infrastructure using multiple custom implants (PATCHCORD, SHEETCORD, HACKERAI). The campaign delivers malicious Inno Setup installers and lures impersonating telecom and government services, employs diverse C2 channels (HTTP C2, Google Sheets, GitHub Gists), supports in-memory shellcode execution and extensive persistence/anti-analysis features, and leverages exposed staging infrastructure containing additional tooling and exploits (including CVE-2024-6387); numerous IOCs (SHA256s, domains, IP, registry keys) are provided.