Patching Into Kabul: Transparent Tribe Turns Its Tradecraft on Afghanistan’s Telecom Backbone- 345

August 16, 2026

A Pakistan-aligned espionage group long associated with spying on India has widened its aim to Afghanistan’s state telecommunications operator, and the tools it brought for the job say as much about the group’s evolution as its targets do. Acronis’s Threat Research Unit has documented an ongoing campaign, attributed with moderate confidence to APT36, also known as Transparent Tribe, that delivers a previously unknown C/C++ backdoor called PATCHCORD through installers impersonating Afghan Telecom, alongside a Go-based sibling, SHEETCORD, that is steered through Google Sheets and aimed at Indian government networks. An exposed staging server completed the picture with a third, AI-assisted implant commanded through GitHub Gists, open-source command frameworks and an OpenSSH exploit. The result is a portrait of a mid-tier state actor professionalising: lures tailored with insider precision, persistence that hides inside the most ordinary click on a workstation, and command channels routed through cloud services that defenders cannot simply block.

The entry point is unusually well researched. Victims receive a ZIP archive named “Telecom_TMS.zip” containing an Inno Setup installer, “TMS_AfghanTelecom.exe,” named after the Transport Management System that Afghan Telecom, the state-owned operator known as AFTEL, uses internally to track vehicle and transport requests. Other lures pose as VPN installers for the same company, matching its name, product fields and even the address of its genuine customer support portal, a level of detail that implies close study of the target rather than mass-produced bait. Once launched, the 64-bit implant hides its console window and, after confirming it holds elevated privileges, takes over the desktop shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox, backing up the originals and rewriting them so that the malware runs first and then opens the real browser. The user sees nothing unusual; every click on a browser icon silently relaunches the backdoor. A registry value named “BeaconBrowserHijack” under the current user’s Run key serves as an infection marker, telling the implant to skip the hijacking if the machine is already compromised, and otherwise ensuring the routine restarts at every logon. PATCHCORD then fingerprints the host and registers with its command server at 46.30.188.13, from which it accepts five instructions: changing its beacon interval, listing processes, executing shellcode entirely in memory, running commands through a hidden shell, and toggling its own persistence remotely. The in-memory execution matters most to investigators, since payloads that never touch disk leave little for forensic recovery.

Pivoting from that infrastructure, Acronis found the campaign’s second front. A website impersonating India’s National Informatics Centre, the agency that runs much of the Indian government’s IT, at the address nic-support[.]site, was distributing SHEETCORD, a Go implant that fuses the earlier SHEETCREEP remote-access tool with PATCHCORD’s features. It executes commands through PowerShell rather than the Windows command prompt, persists through a Visual Basic script in the Startup folder, extends the browser-shortcut trick to Brave, Opera and Vivaldi, and abandons a conventional server altogether: each victim receives its own tab in a Google Sheets spreadsheet, through which instructions arrive and results leave, blending into traffic that few corporate networks would ever question. PATCHCORD itself has been active since at least March 2026, including against India’s energy sector with a variant hardened by anti-analysis and anti-debugging checks. The infrastructure was still live at publication, its domains rotating around a single server that remained constant for months, among them look-alikes of Afghan operators and a hijacked legitimate healthcare domain.

The operator’s most consequential error was leaving a staging server open. It exposed the whole workshop: the open-source command frameworks antnium, GateSentinel and SuperShell, the last a Chinese-language tool; several remote-access frameworks and credential-harvesting utilities; exploit code for CVE-2024-6387, the OpenSSH flaw known as regreSSHion; and files resembling an iOS call-history database, a hint that mobile devices may also be in the collection. It also held a third family, the HACKERAI C2 agent, which overlaps with PATCHCORD and SHEETCORD but commands its victims through GitHub Gists and bears the marks of AI-assisted coding: leftover debug messages, comments in the style of a language model, and a redundant double XOR routine applying the same key twice. Here generative AI appears not as an autonomous attacker but as an ordinary productivity shortcut for a state-backed developer.

Acronis bases its attribution on stacked rather than decisive evidence: credential-harvesting tools seen in confirmed APT36 operations, a command framework that other researchers have independently tied to the group, and a Google Sheets technique closely resembling an earlier Transparent Tribe campaign. The shift in emphasis is the strategic signal. Transparent Tribe built its reputation against Indian government, military and diplomatic targets; this campaign places Afghan telecommunications at the centre, alongside government, defence and energy organisations across South Asia. Control of a country’s carrier networks offers precisely the vantage point an intelligence service values when relations with a neighbour are volatile, and relations between Islamabad and Kabul’s Taliban authorities have deteriorated sharply, including deadly border clashes in late 2025. For defenders in the region the lesson is practical: lures this precise defeat generic awareness training, and the meaningful detections lie in behaviour, such as modified browser shortcuts, unexpected registry Run values and endpoints talking persistently to Google Sheets or GitHub Gists.