A threat cluster targeting Afghan telecom operators is running its command-and-control channel out of Google Sheets, a technique built specifically to look like ordinary SaaS traffic to a defender’s monitoring tools.
What happened. Acronis’ Threat Research Unit documented an espionage campaign it calls PATCHCORD, which delivers a custom C/C++ backdoor through fake VPN installers and telecom management tools impersonating legitimate Afghan Telecom software. Once installed, the malware hijacks browser shortcuts for Edge, Chrome, and Firefox to run silently before launching the real browser, so a victim sees nothing unusual. Acronis linked PATCHCORD with moderate confidence to APT36, also known as Transparent Tribe, a group with a documented history of targeting Indian government and defense organizations, based on overlapping credential-harvesting tools and shared infrastructure. Acronis also found an exposed staging server holding the operators’ full toolkit, including a related Go-based implant named SHEETCORD, which uses the Google Sheets API for command-and-control, creating a dedicated spreadsheet tab per victim. The moderate-confidence link to APT36 lands in the same week this desk covered Jewelbug, a separate state-linked actor running espionage and cryptocurrency theft out of one operation, another sign that nation-state clusters are increasingly running dual-purpose campaigns rather than staying confined to a single mission.
Why it matters. Targets span Afghan telecom operators and South Asian government, defense, and energy-sector organizations, the critical infrastructure layer where an implant with persistence and remote command execution translates directly into intelligence collection or disruption risk.
The insight. Routing command-and-control through Google Sheets is the same defensive-evasion logic this desk has tracked in other state-linked campaigns this year, including malware using Microsoft 365 calendars as a C2 channel: abusing a SaaS platform employees already trust so the traffic blends into an allow-listed domain instead of tripping a network-layer detection rule. SOC teams should not assume traffic to sheets.googleapis.com or calendar.microsoft.com is automatically benign, and should be alerting on anomalous API usage patterns to consumer SaaS platforms from endpoints that have no business reason to touch them, the same way they would flag unexpected outbound connections to an unfamiliar IP.
Source: Acronis Threat Research Unit
