As reported by Security Affairs, Acronis's Threat Research Unit has documented a sophisticated espionage operation deploying a previously undocumented backdoor called PATCHCORD — suspected to be the work of APT36 (also known as Transparent Tribe), a Pakistan-linked threat actor with a long history of targeting South Asian government and military entities.
Why This Campaign Represents a Meaningful Shift in APT Tradecraft
What makes PATCHCORD operationally significant isn't just the targeting — Afghan telecommunications infrastructure and South Asian government entities are unsurprising APT36 territory. What demands attention is the command-and-control architecture. Leveraging Google Sheets as a C2 channel is not novel in isolation, but the combination of that technique with fake VPN tooling as an initial access vector reflects a deliberate, layered approach to evading both perimeter controls and behavioral detection.
Legitimate cloud services like Google Sheets, OneDrive, and Slack have become increasingly attractive to advanced threat actors for a simple reason: security tools trained to flag anomalous outbound traffic to unfamiliar IPs will rarely raise alarms over HTTPS connections to Google's infrastructure. The signal is buried in noise that most organizations have implicitly whitelisted.
The central challenge here isn't detecting the malware — it's detecting malicious intent inside trusted protocol flows. That requires behavioral analytics, not just signature matching.
Who Is Actually at Risk
The immediate victims are South Asian telecommunications providers and government-adjacent infrastructure — targets consistent with APT36's established focus on intelligence collection related to Pakistani geopolitical interests. However, the broader risk surface extends beyond the immediate targets:
The Broader Implication: Cloud Services as Attack Infrastructure
PATCHCORD is the latest in a growing pattern. Threat actors across the sophistication spectrum — from APT29 using legitimate Microsoft services to criminal groups abusing Telegram bots — have recognized that defenders cannot simply block cloud productivity platforms without crippling legitimate operations. This creates a structural advantage for attackers that defenders need to address systematically rather than reactively.
Organizations need to stop treating traffic to trusted cloud domains as inherently benign. The question is not where the traffic goes — it's what the traffic is doing and why a specific endpoint is generating it. A finance workstation with no business purpose connecting to Google Sheets APIs at irregular intervals is a detection opportunity, regardless of the destination's reputation score.
Shield53 Recommendations
Immediate Actions
- Audit outbound Google API traffic: Establish a behavioral baseline for Google Workspace API calls from endpoints. Flag anomalous patterns — particularly from non-standard applications, off-hours timing, or endpoints without documented G Suite usage.
- Enforce application allowlisting: Fake VPN tools succeed because users execute unsigned or poorly-vetted installers. Application control policies that require signed executables from approved vendors dramatically reduce this vector.
- Implement DNS-layer inspection: Solutions like Cisco Umbrella, Infoblox, or open-source RPZ implementations can identify unexpected API calls to cloud services outside of known application patterns.
- Hunt for PATCHCORD indicators: Engage your threat hunting team with the IOCs from Acronis's report. Look for persistence mechanisms, unusual process trees spawning from VPN installer processes, and unexpected scheduled tasks.
- Review VPN software procurement: Validate the integrity of all VPN client software in use across your organization. Require hash verification and signed packages from vendor-controlled distribution channels only.
Strategic Controls
- Deploy User and Entity Behavior Analytics (UEBA) capable of detecting abuse of legitimate cloud services — this is a gap that traditional SIEM rules often cannot close alone.
- Segment high-value targets: Telecom backbone systems, OT-adjacent networks, and government-interface systems should operate under enhanced monitoring profiles with stricter egress filtering.
- Brief your threat intelligence team on APT36 TTPs: The MITRE ATT&CK framework has detailed coverage of Transparent Tribe's known techniques — ensure your detection rules map to their documented playbook, not just known malware hashes.
The PATCHCORD campaign is a reminder that sophisticated threat actors do not need exotic zero-days when operational security gaps and trusted infrastructure abuse remain effective. The best defense is a detection posture sophisticated enough to find malicious behavior regardless of how legitimate the underlying tools appear.
