PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management

A newly uncovered espionage operation targeting Afghan telecom providers and South Asian critical infrastructure has exposed a layered attacker ecosystem built around custom implants, spoofed delivery portals, cloud-backed command-and-control channels.

The campaign began with sector-specific social-engineering lures, including a malicious Inno Setup package named TMS_AfghanTelecom.exe, distributed within a ZIP archive masquerading as Afghan Telecom’s telecom-management software.

The installer’s metadata, publisher strings, and portal URL were crafted to resemble the legitimate Afghan Telecom environment, showing that the operators had tailored their deception to the intended victim basis.

Once launched, PATCHCORD establishes persistence by hijacking browser shortcuts for Microsoft Edge, Google Chrome, and Mozilla Firefox.

It replaces a legitimate browser shortcut’s target with its own executable while retaining the original browser path as an argument and preserving the expected icon.

When a user launches the browser, the malware runs first, starts the genuine application to avoid suspicion, and continues its background activity.

PATCHCORD then fingerprints the host, collecting details such as hostname, username, operating-system version, process ID, executable path, and process name.

It registers the victim with the hard-coded C2 domain appstoore[.]solutions, which was tied to IP address 46.30.188[.]13 on TCP port 8080.

The implant polls /api.jsp for commands and uses a Beacon/1.0.0 user agent with 30-second connection, send, and receive timeouts.

The remote-access capability is particularly notable. PATCHCORD can modify its beacon interval, enumerate running processes, execute arbitrary commands through cmd.exe /c, and manage browser-hijack persistence remotely.

It can also decode and decrypt operator-supplied shellcode, allocate executable memory with VirtualAlloc, and launch it through CreateThread without writing the payload to disk.

This memory-only execution chain gives operators a lower-artifact mechanism for deploying follow-on tooling.

Acronis Threat Research Unit (TRU) tracks the core Windows backdoor as PATCHCORD, assessing with moderate confidence that the activity overlaps with the APT36, or Transparent Tribe, threat cluster.

Infrastructure analysis connected the PATCHCORD server to an exposed staging environment containing Metasploit artifacts, credential-harvesting utilities, brute-force material, exploit tooling for CVE-2024-6387 better known as regreSSHion and several RAT and C2 projects.

PATCHCORD Infrastructure Hosts SuperShell

The presence of regreSSHion tooling is operationally significant: vulnerable, internet-facing OpenSSH deployments may offer an initial-access path into telecom, government, and other high-value environments before operators deploy endpoint malware.

Among the most revealing discoveries was SuperShell v2.0.0, an open-source Chinese-language C2 and webshell-management platform present on the staging infrastructure.

SuperShell provides browser-accessible remote command execution, file management, reverse-shell functionality, and collaborative C2 operations.

Its login interface was exposed through the infrastructure on port 443, while related SuperShell signatures were observed on a separate host on port 8080.

Acronis found an infrastructure overlap with a server previously tied by Kaspersky to SilverFox/ValleyRAT activity, but emphasized that this overlap does not establish coordination or attribution between the respective groups.

The campaign also extends beyond PATCHCORD. A fake NIC-themed portal, nic-support[.]site, distributed a Go-based successor called SHEETCORD under the guise of a “Ministry of Defense Employee Breach Update.”

SHEETCORD executes PowerShell commands, persists through a Startup-folder VBScript and Run key, targets six browsers for shortcut hijacking, and uses the Google Sheets API with hard-coded service-account credentials to create per-victim tabs for tasking and response collection.

A third implant, HACKERAI C2 Agent, uses GitHub Gists for tasking and exfiltration. Together, the custom HTTP, Google Sheets, and GitHub Gists channels demonstrate an operator actively diversifying C2 transport to complicate network detection.

For defenders, priority actions include blocking and investigating the identified domains and IP, reviewing browser shortcut modifications, hunting for suspicious Run-key values and Startup-folder scripts, and monitoring unusual Google Sheets API or GitHub Gist activity from endpoints.

IOCs

File name	Type / Role	SHA-256
TMS_AfghanTelecom.exe	Installer / Dropper	cf7184c0dfe882dc6e3016f16e4ede32b75d7648f83d6f4f87eb6a703be7b8d6
AFTEL_VPN_Setup.exe	Installer / Dropper	1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94
NHPC_Fuel_Conservation_Setup.zip	Installer archive / Dropper	ea0934472121848b80455581d289ce4480b1e5cc05678c1b90ecfc465b5ec350
nhpcfuelconservationservice.exe	Installer / Dropper	5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a
MDEB_Update_Setup.exe	Installer / Dropper	378484112b4e837d3850b5b0802fc509202c232bb124d6944a59fe66525ba668

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now