Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks

Transparent Tribe (APT36), likely state-aligned, is actively conducting espionage against high-value Afghan government and telecom targets and staging tailored phishing against Indian government and defense organizations; researchers observed new malware families (Patchcord, Sheetcord, Sheetcreep) and a tool named HackerAI, with confirmed infections in Afghanistan and attempts against Indian entities. Patchcord features in-memory execution and an observable persistence method (browser shortcut hijacking), while Sheetcord/Sheetcreep use startup persistence and exfiltrate or command via Google Sheets, indicating a mix of low-stealth TTPs and more evasive techniques.