PATCHCORD and SHEETCORD: when the C2 channel is a spreadsheet you already allow

Acronis's Threat Research Unit says it has identified an ongoing campaign delivering a previously undocumented C/C++ backdoor it tracks as PATCHCORD against Afghan telecom providers and South Asian critical infrastructure organisations ^[1][2]. The consequential detail is not the implant, it is the plumbing: a second, related implant found by pivoting on the same infrastructure runs its command and control through the Google Sheets API, which is to say through a service most enterprises have already allowlisted and stopped inspecting ^[3][12].

The delivery side is equally unhelpful for anyone relying on user suspicion. PATCHCORD arrives via sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools ^[2]. According to Acronis, one installer matched the real company name, the product fields, and the URL of the genuine support portal that customers actually use ^[4]. Run it and a 64-bit Windows implant installs itself while a real browser session opens normally in the background, so the victim sees the outcome they expected ^[5].

Persistence is where the operator spent effort. Rather than the usual registry autorun, PATCHCORD checks whether it is running with elevated privileges, then hijacks the shortcut files for Microsoft Edge, Google Chrome and Mozilla Firefox, backing up the originals and rewriting them so the malware launches first and the real browser starts silently afterwards ^[6][7]. The shortcut keeps working, which is the point. Once installed, the implant supports five capabilities: changing its check-in interval, listing running processes, executing shellcode entirely in memory, running arbitrary commands through a hidden shell, and remotely controlling its own shortcut-hijacking persistence ^[8]. The in-memory execution path means the payload never touches disk, so post-incident forensics has less to work with ^[9].

SHEETCORD, the Go-based implant, was distributed through a domain impersonating India's National Informatics Centre ^[3]. Acronis assesses it as a tooling evolution, combining functionality previously seen in the SHEETCREEP RAT with capabilities introduced in PATCHCORD ^[10]. Its shell execution routine drops cmd.exe /c in favour of powershell -Command with script block wrapping ^[11]. More important operationally, it abandons the traditional web server entirely and creates a dedicated spreadsheet tab per victim for tasking and exfiltration ^[12].

A third family in the same reporting, HACKERAI C2 Agent, does the same job with GitHub Gists, and Acronis points to leftover debug messages and AI-style code comments as evidence it was built with AI coding assistance ^[13]. That makes two of the three documented families using ordinary third-party platforms as their transport ^[15].

Egress filtering built on domain reputation and destination allowlists does not see any of this. Traffic to sheets.googleapis.com or gist.github.com from a corporate endpoint is indistinguishable from work unless you are inspecting which account is authenticating, how often, and with what request pattern. Most organisations are not.

Attribution is thinner than the technical detail. Security Affairs headlines the campaign as suspected APT36 activity ^[14], while the Acronis material quoted in that report refers only to "the operator" when describing the tooling lineage ^[10].

Worth watching: whether defenders begin treating SaaS API telemetry, specifically authenticated-account identity and request cadence, as a detection surface rather than a blind spot, and whether browser shortcut integrity gets monitored at all outside of specialist EDR configurations ^[6][12]. Also worth watching is reuse: the per-victim spreadsheet tab is an operational convenience for the attacker and a potential enumeration opportunity for anyone who gets access to the account behind it ^[12].