Home › Threat Actors › APT36
← All Threat Actors
Nation-State high Pakistan

APT36

Pakistan — attribution to APT36/Transparent Tribe assessed with moderate confidence by Acronis TRU, based on targeting geography, malware construction, and infrastructure reuse (this specific PATCHCORD campaign is not confirmed attribution beyond moderate confidence) · Espionage / intelligence collection, with strategic interest in Afghan telecom metadata visibility and continued focus on Indian government/military/diplomatic targets

Reports 1
Active Since 2013
Last Reported 17 Aug 2026
Sectors Targeted communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Sector-tailored lures: ZIP archive ('Telecom_TMS.zip') containing an Inno Setup installer ('TMS_AfghanTelecom.exe') disguised as Afghan Telecom's internal Transport Management System tool
  • Fake VPN installers impersonating AFTEL, the Afghan national telecom provider
  • PATCHCORD: compiled C/C++ backdoor for persistent access, command execution, and file transfer, beaconing to hardcoded C2 at 46.30.188[.]13
  • SHEETCORD: uses Google Sheets as a C2 channel (commands pushed as spreadsheet entries, results retrieved via the same API) to blend with legitimate enterprise traffic
  • HACKERAI C2 Agent: routes C2 through GitHub Gists as a redundant trusted-platform channel

Known Targets

Afghan telecommunications providers (Afghan Telecom / AFTEL)South Asian/Afghan critical infrastructureIndian government, military, and diplomatic entities (longstanding primary focus)Indian critical infrastructure — energy, defence, and government IT contractors (secondary/historical targeting)

Analyst Notes

Acronis TRU research documents a previously undisclosed three-malware cluster — PATCHCORD, SHEETCORD, and the GitHub-based 'HACKERAI' C2 agent — all operating from shared infrastructure, active since at least March 2026. Notable strategic shift: primary targeting of Afghan national telecom (rather than APT36's historically India-centric focus), consistent with Pakistani intelligence interest in Afghan communications infrastructure.

Also Known As

Transparent Tribe

MITRE ATT&CK Techniques

T1204.002 User Execution: Malicious File T1102.002 Web Service: Bidirectional Communication T1105 Ingress Tool Transfer

Intelligence Reports

Briefing communicationscritical-infrastructure

APT36 Campaign Deploys Three-Malware Cluster Against Afghan Telecom and South Asian Infrastructure

Acronis TRU has documented three previously undisclosed malware families — PATCHCORD, SHEETCORD, and a GitHub-based C2 agent — targeting Afghan telecom providers and Indian critical infrastructure in an espionage campaign active since March 2026.

17 Aug 2026 · 4 min read