Cyber Espionage Campaign Targets South Asian Infrastructure and Afghan Telecoms

Key facts

According to technical analysis released by the Acronis Threat Research Unit (TRU), cybersecurity analysts detected an active intrusion campaign targeting key communications and municipal infrastructure entities. The core element of the intrusion set is a novel malicious implant designated as PATCHCORD.

Engineered using C and C++ programming languages, PATCHCORD was specifically compiled to evade standard endpoint detection systems while establishing a stealthy foothold within high-value target networks. Once deployed, the custom malware functions as an administrative backdoor, granting its operators remote command-and-control capabilities over infected host machines. This enables threat actors to upload secondary payloads, extract sensitive internal documents, collect network topology data, and maintain long-term persistence without triggering routine security alerts.

Acronis researchers observed that the attackers selectively focused their deployment on telecommunications service providers operating within Afghanistan, as well as broader critical infrastructure organizations across South Asian nations. The vector of entry involved tailored, sector-specific targeting designed to exploit vulnerable entry points in enterprise networks. The ongoing nature of the campaign indicates that the threat group responsible continues to actively conduct operations, refining their toolsets to maintain access to high-priority targets across the region.

Why it matters

The targeting of telecommunications providers and critical infrastructure represents a high-severity threat to national security, economic stability, and public safety across South Asia. Telecommunications networks serve as the backbone of modern communication, facilitating government administration, financial transactions, military communications, and civilian data exchanges. When adversary groups compromise telecom architecture, they gain potential access to call detail records (CDRs), short message service (SMS) traffic, location tracking data, and raw voice feeds, enabling comprehensive intelligence gathering on key personnel and state officials.

In critical infrastructure sectors—such as energy grids, water distribution, transport networks, and financial institutions—the presence of persistent backdoors creates risks that extend beyond espionage. While the primary objective of PATCHCORD appears aligned with intelligence collection, persistent C/C++ backdoors in operational or administrative networks provide attackers with the structural access necessary to deploy destructive payloads or disrupt essential public services during periods of heightened geopolitical tension.

For South Asia and Afghanistan, where digital infrastructure often operates under resource constraints and mixed technical architecture, the discovery of a bespoke malware cluster underlines the persistent attention of advanced cyber espionage groups. The compromise of Afghan telecom providers is particularly significant given the country's reliance on wireless networks for domestic governance, economic activity, and international connectivity.

The South Asian subcontinent and Afghanistan have long been major arenas for state-sponsored cyber espionage and strategic intelligence gathering. Over the past decade, numerous threat groups associated with regional powers and global state actors have operated continuously across the area, routinely targeting government ministries, military defense contractors, telecommunications entities, and critical industrial sectors.

Telecommunications operators globally have increasingly become preferred targets for advanced persistent threat (APT) groups. Historical campaigns—such as those involving the LightBasin threat actor or the Soft Cell operations targeting global mobile networks—demonstrated how threat actors leverage compromised telecom infrastructure to conduct targeted surveillance across international borders without needing to infect individual mobile devices. By embedding backdoors deep within core switching networks or domain controllers, attackers can passively mirror traffic and monitor entire user bases.

In Afghanistan, the digital communications environment has experienced severe disruption and transformation following the political shifts and government change in August 2021. The nation's telecom infrastructure, composed of private mobile operators and state-managed optical fiber networks, relies heavily on international transit routes and legacy equipment. This fragmented environment creates unique security vulnerabilities, making Afghan telecom operators attractive targets for intelligence agencies seeking insight into regional security dynamics, counterterrorism operations, and cross-border movements.

Custom C and C++ backdoors remain the preferred tool for sophisticated cyber espionage units. Unlike off-the-shelf commercial remote access trojans (RATs) or widely available open-source frameworks, proprietary malware like PATCHCORD requires dedicated development resources and reverse-engineering capabilities to detect. By building tailored implants from scratch, threat actors can bypass traditional signature-based antivirus software and maintain undetected operational persistence for months or years.

Reaction

Following the public disclosure by Acronis, security operations teams, regional computer emergency response teams (CERTs), and telecommunications regulators across South Asia are expected to conduct internal forensic audits to determine whether their networks contain indicators of compromise related to PATCHCORD.

Industry analysts expect cybersecurity authorities in targeted jurisdictions to issue technical advisories advising infrastructure operators to update network defense signatures, audit privileged user accounts, and review perimeter firewalls. Neither government officials in Afghanistan nor regulatory authorities in neighboring South Asian nations have issued public statements directly naming specific affected entities, reflecting the standard confidentiality protocols typically maintained during active national security investigations involving critical infrastructure breaches.

What we don't know yet

Several critical dimensions of the PATCHCORD campaign remain undisclosed or under investigation. The Acronis report does not explicitly attribute the malware to a known named threat actor or state-sponsored APT group. Establishing definitive attribution requires extensive forensic correlation, including code overlap analysis, command-and-control server infrastructure mapping, and language artifact inspection, which remain ongoing.

Additionally, the exact number of compromised organizations, the precise geographic distribution of targets outside Afghanistan, and the full extent of data exfiltrated during the campaign have not been publicly detailed. It also remains unclear precisely how the initial intrusion vectors were executed across all affected targets, specifically whether attackers relied primarily on spear-phishing emails, software vulnerability exploits, or compromised third-party vendor supply chains.

What to watch

In the coming weeks and months, cybersecurity researchers and network administrators should monitor several key developments to gauge the evolution of the PATCHCORD threat environment:

This report is based on original threat intelligence and research published by the Acronis Threat Research Unit (TRU) on August 26, 2026.