PATCHCORD Malware Targets Afghan Telecom and South Asian Critical Infrastructure

Acronis Threat Research Unit (TRU) has discovered an active campaign deploying a previously unknown custom backdoor, named PATCHCORD. The malware, written in C/C++, targets Afghan telecom providers and South Asian critical infrastructure organizations. It is distributed via sector-specific lures, including fake VPN installers mimicking Afghan Telecom (AFTEL) and telecom management tools.