PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Summary

An ongoing campaign is deploying custom malware families, including PATCHCORD and SHEETCORD, against telecommunications providers and critical infrastructure across South Asia. The activity involves custom C/C++ and Go-based implants that use multiple command-and-control methods, including Google Sheets and GitHub Gists. The campaign demonstrates continued evolution in both targeting and operational tradecraft.

Investigation

The Acronis Threat Research Unit uncovered the campaign after analyzing a suspicious ZIP archive containing a malicious Inno Setup installer. Pivoting across associated C2 infrastructure revealed several malware families, including PATCHCORD, SHEETCORD, and HACKERAI C2, along with an exposed staging server containing the operator’s toolkit. Researchers linked the activity to the APT36 cluster based on targeting patterns and shared infrastructure.

Mitigation

Organizations should prioritize patching OpenSSH to address regreSSHion, tracked as CVE-2024-6387, and monitor for unauthorized modifications to registry Run keys. Enforcing controls around browser shortcut integrity and detecting suspicious VBScript execution can help prevent persistence. EDR/XDR solutions should also detect in-memory shellcode execution and anomalous cloud service API activity.

Response

If malicious activity is detected, compromised systems should be isolated immediately to limit lateral movement and credential exfiltration. Investigators should examine browser shortcuts and registry keys for persistence mechanisms. Google Cloud Platform and GitHub activity should also be reviewed for unauthorized service accounts, tokens, or connections matching identified C2 patterns.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access to a workstation and dropped a specialized implant named TMS_AfghanTelecom.exe into a user-writable directory. To evade standard file-based antivirus, the attacker executes the implant using specific command-line parameters that instruct the binary to reflectively load shellcode directly into memory, bypassing disk-based scanning. This specific command line (In-memory shellcode execution) is a known artifact of this malware family.

• Regression Test Script:

  # Simulation Script for PATCHCORD Detection Validation
  # This script creates a dummy file to simulate the implant and executes it with the target strings.
  
  $workDir = "$env:TEMPPatchcordSim"
  if (!(Test-Path $workDir)) { New-Item -ItemType Directory -Path $workDir }
  
  $implantName = "TMS_AfghanTelecom.exe"
  $implantPath = Join-Path $workDir $implantName
  
  # Create a dummy executable (using a renamed system tool for simulation safety)
  Copy-Item "C:WindowsSystem32cmd.exe" $implantPath
  
  # Execute the 'implant' with the specific strings defined in the Sigma rule
  Write-Host "[!] Executing simulated PATCHCORD implant..." -ForegroundColor Red
  Start-Process -FilePath $implantPath -ArgumentList "PATCHCORD main execution flow --mode 'In-memory shellcode execution' --target 'Remote shell execution'" -Wait
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  $workDir = "$env:TEMPPatchcordSim"
  if (Test-Path $workDir) {
      Remove-Item -Recurse -Force $workDir
      Write-Host "[+] Cleanup successful: Removed simulated implant directory." -ForegroundColor Cyan
  }