Pakistani state-linked threat actor Transparent Tribe (APT 36) has refreshed its malware toolkit with new backdoors named Patchcord and Sheetcord, alongside a RAT called Sheetcreep, to spy on high-value targets in Afghanistan and India. Patchcord, a C++ implant, favors in-memory execution and anti-analysis checks but relies on an old, easily detected persistence trick of hijacking desktop shortcuts. Sheetcord, written in Go, instead registers as a Windows startup process and hides C2 traffic via Google Sheets. A third framework, HackerAI, appears to be AI-generated malware using GitHub Gist for C2. The campaign, active since at least last December and intensifying in May, has successfully compromised an Afghan telecom subsidiary and an IT officer at Afghan Telecom, while attacks against better-defended Indian government agencies like the Ministries of Defense and Foreign Affairs have so far failed.
Table of contents
Transparent Tribe's Cyberattacks in Afghanistan & IndiaThe Patchcord Pakistani Backdoor MalwareHow to Detect, or Block, Transparent Tribe CyberattacksQuestions this post answers
What is Patchcord malware and how does it maintain persistence on infected systems?
Patchcord is a C++ backdoor used by the Pakistani APT group Transparent Tribe that executes arbitrary code in-memory and includes checks to detect virtual machines or sandbox environments. Despite these evasive capabilities, its main persistence mechanism is hijacking victims' desktop browser shortcuts, rewriting them to launch the malware before opening the intended browser, a dated technique that most endpoint security products readily detect. Security teams tracking emerging APT tooling like Patchcord follow threat intelligence breakdowns on daily.dev.
How does the Sheetcord malware hide its command and control traffic?
Sheetcord, a Go-based evolution of the Patchcord backdoor used by Transparent Tribe, conceals its command-and-control traffic by routing it through Google Sheets rather than traditional C2 infrastructure. Unlike Patchcord's shortcut-hijacking persistence, Sheetcord registers itself as a Windows startup process, and it is often deployed alongside a related remote access Trojan called Sheetcreep. Anyone hunting for stealthy C2 techniques like this can follow malware research threads on daily.dev.
Why is Transparent Tribe more successful attacking Afghanistan than India?
Afghan targets have weaker cybersecurity maturity, letting Transparent Tribe get away with lower-effort tools, including a suspected AI-generated malware framework called HackerAI that uses GitHub Gist for command and control. Indian government agencies, including the Ministries of Defense and Foreign Affairs and the Indian Air Force, have so far resisted successful compromise, with India's CERT-In defending mainly by blocking the group's well-known infrastructure. Teams comparing regional threat exposure and APT tradecraft can track these reports on daily.dev.