CERT24APT36 suspected in PATCHCORD espionage campaign using Google Sheets as C2Loading data…
CERT24Threat Observatory
Period

APT36 suspected in PATCHCORD espionage campaign using Google Sheets as C2

Acronis described an ongoing espionage campaign in which the previously undocumented PATCHCORD backdoor is delivered through fake VPN installers and telecommunications management tools to Afghan telecom providers and South Asian critical infrastructure organizations. The related SHEETCORD implant uses the Google Sheets API for command and control. Acronis links the activity to APT36, also known as Transparent Tribe, with moderate confidence.

← Back to intelligence

APT36 suspected in PATCHCORD espionage campaign using Google Sheets as C2

Acronis described an ongoing espionage campaign in which the previously undocumented PATCHCORD backdoor is delivered through fake VPN installers and telecommunications management tools to Afghan telecom providers and South Asian critical infrastructure organizations. The related SHEETCORD implant uses the Google Sheets API for command and control. Acronis links the activity to APT36, also known as Transparent Tribe, with moderate confidence.