CTI · corroborated · 2026-08-14

APT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware Development

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1071 Application Layer Protocol Command and Control
• T1505 Server Software Component Persistence

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: APT36 HACKERAI Campaign Delivery Executable
id: f8365f53-ac9b-43e5-bbed-8bc617847c3c
status: experimental
description: >
    Detects execution of TMS_AfghanTelecom.exe, the malicious Inno Setup
    package used by the APT36-linked PATCHCORD/SHEETCORD/HACKERAI campaign
    against Afghan telecom providers (Aug 2026). The installer was distributed
    inside a ZIP archive masquerading as Afghan Telecom telecom-management
    software and leads to implant execution and C2 beaconing.
references:
    - https://cyberpress.org/apt36-hackerai-llm-assisted-implant/
    - https://gbhackers.com/patchcord-infrastructure-hosts-supershell/
author: Tia N. List
date: 2026/08/14
tags:
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_installer:
        Image|endswith: '\TMS_AfghanTelecom.exe'
    condition: selection_installer
falsepositives:
    - Legitimate Afghan Telecom-branded management software using the same
      installer name is not known; verify the binary origin and Inno Setup
      payload behavior before escalating
level: high

Splunk SPL raw

# apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar — Splunk SPL variant (derived from apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar.sigma via sigma convert)
# source-sha256: 31ced1c2d6d28865e02fe3e974b417cc5891fb66aeddd79e93c3077c3bf197e0 v1
Image="*\\TMS_AfghanTelecom.exe"

KQL (Sentinel / Defender) raw

# apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar — KQL variant (derived from apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar.sigma via sigma convert)
# source-sha256: 31ced1c2d6d28865e02fe3e974b417cc5891fb66aeddd79e93c3077c3bf197e0 v1
Image endswith "\\TMS_AfghanTelecom.exe"

References

• https://cyberpress.org/apt36-hackerai-llm-assisted-implant/
• https://gbhackers.com/patchcord-infrastructure-hosts-supershell/