APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2

**Executive summary:** Acronis Threat Research Unit uncovered an ongoing espionage campaign—tracked as PATCHCORD—that uses sector-specific lures (fake VPN installers and management tools) to deploy a Windows backdoor which persists by hijacking browser shortcuts; follow-on tooling (SHEETCORD, HACKERAI) abuses Google Sheets and GitHub Gists for C2, and an exposed staging server revealed the operator's toolkit and links to APT36 with moderate confidence.