New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit (TRU), the backdoor is a compiled C/C++ implant delivered by means of sector-specific lures, including fake VPN installers impersonating Afghan Telecom (

The article reports that Afghan telecom providers and South Asian critical infrastructure organizations are being targeted by a campaign delivering a new PATCHCORD backdoor via sector-specific lures such as fake VPN installers impersonating Afghan Telecom; it is described as a compiled C/C++ implant by Acronis TRU. This is traditional cyber-espionage malware rather than an AI-specific attack, but it highlights risks to the broader digital supply chain that AI systems may depend on. RealGround’s analysis: organizations deploying AI agents or models within telecom and critical infrastructure need to treat endpoint software (e.g., VPN clients, support tools) as part of their AI supply chain, enforce strong software provenance and SBOM practices, and continuously red-team AI-enabled workflows against compromise of underlying infrastructure. Compromised endpoints and networks can indirectly undermine AI assurance, leading to coerced agent behavior or data exposure even when the AI components themselves are secure.