Loading story…
Researchers reported an active cyber espionage campaign linked with moderate confidence to APT36 (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to Afghan Telecom, government updates, and software installers. The operation uses a malware cluster that includes HACKERAI C2 Agent, PATCHCORD, and SHEETCORD, showing an evolution from earlier custom C/C++ tooling to newer Go-based implants.
The malware uses legitimate cloud services as covert command-and-control channels, with HACKERAI abusing GitHub Gists and SHEETCORD using Google Sheets for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple SHA-256 hashes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
As of 2026-08-14, reporting stated that the campaign infrastructure remained active and associated phishing operations were ongoing. The actor was also described as continuing to expand its cloud-based command-and-control infrastructure.
In March 2026, the operator used a PATCHCORD variant masquerading as an NHPC Fuel Conservation Client installer to target India’s energy sector. Acronis reported this variant also included anti-analysis checks for virtual machines, debuggers, low-resource environments, analysis ports, security tools, and sandbox-like inactivity.
A Golang-based credential stealer dubbed GoStealer was reported targeting Indian Air Force officials. The disclosure identifies a distinct malware/tooling development and a specific victim set not already reflected in the timeline.
Researchers found an exposed staging server containing phishing archives, credential theft tools, exploit code, and several command-and-control frameworks. They assessed this as evidence the operator was preparing multiple campaigns simultaneously.
The activity was assessed with moderate confidence as overlapping with APT36, also known as Transparent Tribe, or a closely related Pakistan-linked actor. Both references describe the malware cluster as part of an APT36-linked espionage campaign.
Acronis researchers identified a malware framework named HACKERAI C2 Agent that uses GitHub Gists for command-and-control and data exfiltration. The malware can collect system information, execute remote commands, and persist by altering browser shortcuts while still launching the legitimate browser.
Researchers identified SHEETCORD, a Go-based variant that uses Google Sheets for command traffic and extends shortcut hijacking to Brave, Opera, and Vivaldi. The reporting describes this as part of the actor’s shift from a custom C/C++ backdoor to Go-based implants.
The campaign used PATCHCORD as its main implant, with persistence achieved by hijacking browser shortcuts for Edge, Chrome, and Firefox. Researchers also associated command-and-control infrastructure including IP address 46.30.188.13 with the operation.
A broader espionage campaign targeted telecom, government, defense, energy, and critical infrastructure organizations in South Asia, including Afghan telecom-themed lures and Indian targets. Lures included fake telecom files, government updates, and software installers.
Researchers linked HACKERAI distribution to a historical domain impersonating India’s Controller General of Defence Accounts, identified as defence.cdga.site. The domain was used before the newer PATCHCORD campaign emerged.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecommunity.gurucul.com
Open sourcecybersecuritynews.com
Open sourceacronis.com
Open sourcexelemental.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a recruitment-themed malware campaign targeting Indian government job seekers with a fake Cabinet Secretariat notice for Senior Field Officer roles. The infection chain delivers a ZIP archive containing a malicious `.lnk` file, a PowerShell script, and a `.NET` executable that installs the legitimate ControlR remote management agent alongside a custom RAT called **SheetAgent**. The malware persists through a scheduled task or Startup-folder shortcut, disguises files with Windows-like names, and uses anti-VM, anti-sandbox, and self-cleanup checks to hinder analysis. Seqrite said SheetAgent uses hardcoded Google service account credentials to access **Google Sheets** and **Google Drive**, with an attacker-controlled sheet acting as a backup command-and-control and exfiltration channel. Investigators also linked infrastructure at `38.242.157.89` to the decoy PDF and several authenticated management panels, including **SecureMonitor** and **PrivateRat**. The tradecraft overlaps with earlier campaigns that used cloud services such as Google Sheets, Firebase, GitHub, and Microsoft Graph for covert C2 against Indian targets, and Seqrite attributed the operation to **APT36** with medium confidence.
Jul 14, 2026
Security researchers reported **Pakistan-linked threat activity** targeting Indian government entities in campaigns dubbed **Gopher Strike** and **Sheet Attack**, assessed with *medium confidence* to potentially originate from a new subgroup or a parallel Pakistan-based actor rather than being definitively attributable to **APT36**. **Sheet Attack** uses legitimate services including **Google Sheets**, **Firebase**, and email for command-and-control (C2), while **Gopher Strike** begins with phishing emails delivering deceptive PDFs that display blurred content and a fake prompt to install an *Adobe Acrobat Reader DC* update. In **Gopher Strike**, clicking the “Download and Install” lure triggers delivery of an **ISO** payload only when server-side checks confirm the victim is in India and using a Windows user agent, a tactic intended to evade automated analysis. The ISO contains a Golang downloader, **GOGITTER**, which creates a VBScript (e.g., `windows_api.vbs`) in common directories (including `C:\Users\Public\Downloads`, `C:\Users\Public\Pictures`, and `%APPDATA%`) to poll for instructions and retrieve additional payloads, including **GITSHELLPAD**, which is described as leveraging **private GitHub repositories** (with embedded authentication tokens) for staging/persistence and follow-on access.
Jun 29, 2026
**APT36 (Transparent Tribe)**, a Pakistan-linked threat group, has been observed targeting Indian government entities and diplomats with a high-volume wave of **AI-generated, low-quality “vibeware” malware**, according to Bitdefender research. The activity reflects a shift away from relying solely on established tooling toward rapidly producing disposable implants—often written in less common languages such as **Nim, Zig, and Crystal**—to increase throughput and potentially reduce detection by traditional antivirus signatures. While much of the code is described as mediocre and error-prone (including examples of broken data-stealing logic), some capabilities are intrusive. Reported tooling includes **LuminousCookies**, which attempts to steal browser data by bypassing Chrome/Edge **App-Bound Encryption** by operating inside the browser’s memory context, and tradecraft intended to mislead attribution (e.g., embedding the common Hindu name **“Kumar”** in file paths and using culturally themed infrastructure naming such as a Discord server labeled **“Jinwoo’s Server”**). Bitdefender also assessed the vibeware approach as a “hybrid” fallback alongside known APT36-associated tooling and TTPs, including use of the open-source **Havoc** C2 framework and a shellcode loader referred to as **Warcode**, emphasizing scalability over sophistication and not relying on zero-days.
Jun 29, 2026