New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Acronis Threat Research Unit (TRU) has uncovered an ongoing cyberattack campaign targeting Afghan telecom providers and critical infrastructure organizations across South Asia. The threat actors are distributing a previously undocumented backdoor designated PATCHCORD. According to the research, PATCHCORD is a compiled C/C++ implant delivered via sector-specific lures, including fake VPN installers that impersonate Afghan Telecom and other region-specific themes. The campaign focuses on gaining initial access through user execution of these malicious installers. Once executed, the backdoor provides unauthorized remote access and control capabilities, though specific technical details regarding its full functionality remain under investigation. The targeting of telecom and critical infrastructure sectors suggests objectives of espionage, data exfiltration, and potential operational disruption. Acronis notes that details regarding threat actor attribution, exact victim counts, and the complete capabilities of the PATCHCORD implant are currently unverified and marked as reported.