Reported by 2 outlets

Timeline

1. original reporting

   APT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware Development

   cyberpress.org · 60d ago · August 14th, 2026

   The activity uses three previously undocumented malware families PATCHCORD, SHEETCORD, and HACKERAI C2 Agent and shows possible links to APT36 , also known as Transparent Tribe. Researchers assess the attribution with moderate confidence. The assessment is based on the group’s targeting patterns, shared infrastructure, malware similarities, and tools found on an exposed staging server. The campaign primarily targets telecom, government, defense, and energy organizations in Afghanistan and India. Telecom companies are high-value targets because attackers can potentially access communications systems, subscriber data, and sensitive government-related information. The campaign shows that the operators are expanding beyond traditional government and military espionage targets. APT36 HackerAI LLM-Assisted Implant The investigation began after researchers found a suspicious ZIP archive named Telecom_TMS on VirusTotal in June 2026. It contained a malicious installer called TMS_AfghanTelecom.exe, designed to appear as a legitimate Afghan Telecom management tool. The installer used Afghan Telecom branding in its file metadata and included the legitimate Afghan Telecom service-request portal in its publisher URL. Afghan Telecom–themed installer metadata (Source: acronis) This social-engineering approach was likely intended to convince employees that the file was safe. After execution, the installer drops PATCHCORD, a custom 64-bit Windows backdoor written in C/C++. The malware hides it

2. update from gbhackers.com

   PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management

   gbhackers.com · 60d ago · August 14th, 2026

   A newly uncovered espionage operation targeting Afghan telecom providers and South Asian critical infrastructure has exposed a layered attacker ecosystem built around custom implants, spoofed delivery portals, cloud-backed command-and-control channels. The campaign began with sector-specific social-engineering lures, including a malicious Inno Setup package named TMS_AfghanTelecom.exe, distributed within a ZIP archive masquerading as Afghan Telecom’s telecom-management […] The post PATCHCORD Infrastructure Hosts SuperShell C2 for Remote Commands and Webshell Management appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .