PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

MITRE Techniques

• [T1036 ] Masquerading – The operators disguised payloads and domains as legitimate telecom and government assets, including fake installers and impersonation domains [‘fake VPN installers impersonating Afghan Telecom (AFTEL)’ and ‘a domain impersonating India’s National Informatics Centre (NIC)’]
• [T1547.009 ] Boot or Logon Autostart Execution: Shortcut Modification – PATCHCORD and SHEETCORD persisted by rewriting browser shortcuts to launch the malware first [‘hijacking browser shortcuts’ and ‘rewrites the shortcut… to the implant’s own executable’]
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – PATCHCORD wrote to a Run key and SHEETCORD used both a Run key and a Startup-folder VBS file for persistence [‘writes its own executable path to this key’ and ‘drops a VBScript file named SystemHelper.vbs into the Windows Startup folder’]
• [T1057 ] Process Discovery – PATCHCORD enumerated running processes and returned names, PIDs, and executable paths [‘Enumerates all running processes on the victim’s system’]
• [T1106 ] Native API – The implants used Windows APIs such as CreateThread, VirtualAlloc, VirtualProtect, ShellExecuteW, and CreateProcessA to execute actions [‘allocated into executable memory via VirtualAlloc’ and ‘executed as a new thread via CreateThread’]
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – PATCHCORD executed remote commands via cmd.exe /c [‘Executes arbitrary commands via cmd.exe /c’]
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – SHEETCORD executed commands using PowerShell [‘it executes commands through powershell -Command with script block wrapping’]
• [T1105 ] Ingress Tool Transfer – The malware downloaded and executed payloads delivered by the operator through C2 tasking and staged installers [‘delivering a previously undocumented custom backdoor’ and ‘receives an encoded payload as part of the tasking response’]
• [T1027 ] Obfuscated Files or Information – The cluster used Base64 encoding, custom alphabets, HTML comment wrappers, and encrypted shellcode to conceal data [‘encoded using the custom Base64 alphabet’ and ‘wrapped in HTML comment markers’]
• [T1041 ] Exfiltration Over C2 Channel – Command output and host data were sent back to C2 servers over HTTP or cloud services [‘captured output… and sent back to the C2 server’ and ‘Google Sheets API v4’]
• [T1071.001 ] Application Layer Protocol: Web Protocols – C2 traffic used HTTP, Google Sheets, and GitHub Gists as application-layer channels [‘communicates with the hardcoded C2 domain’ and ‘abuses Google Sheets for command-and-control’]
• [T1567.002 ] Exfiltration to Cloud Storage – SHEETCORD used Google Sheets as a bidirectional cloud C2 channel [‘creates per-victim tabs in the operator’s spreadsheet for bidirectional communication’]