PATCHCORD, SHEETCORD & Evooo1Bot: Google Sheets C2 Backdoors and Multi-Functional Linux Botnet — OTX Pulse Detection Pack

Two converging intelligence pulses published to AlienVault OTX on 2026-09-12 paint a picture of an escalating credential-theft and access-brokerage ecosystem spanning both targeted espionage and opportunistic botnet operations.

The first pulse documents a previously undocumented malware cluster attributed to Operation C-Major, centered on the custom C/C++ backdoor PATCHCORD and its sibling implant SHEETCORD — a Go-based backdoor that abuses Google Sheets as a command-and-control channel. The campaign targets Afghan telecommunications providers and South Asian critical infrastructure across government, defense, energy, and healthcare sectors. Delivery relies on sector-specific social engineering: fake VPN installers impersonating Afghan Telecom and bogus telecom management tooling. Once inside, the cluster deploys a full post-exploitation stack including ValleyRAT, GateSentinel, HackBrowserData (a browser credential stealer), and SuperShell, indicating a dual objective of persistent access and bulk credential harvesting.

The second pulse details Evooo1Bot, a multi-functional Linux botnet active since July 2026 that extends the Mirai DDoS engine with encrypted C2, SSH brute-force scanning, SOCKS relaying, credential sniffing, and an integrated exploit arsenal targeting a long tail of edge-device vulnerabilities (CVE-2021-36260, CVE-2022-29464, CVE-2021-46422, CVE-2016-6277, and others).

Collectively, these pulses reveal the same strategic pattern: edge infrastructure and telecom operators are being converted into credential reservoirs and proxy infrastructure. Stolen browser credentials and sniffed SSH secrets from these environments feed dark web access markets and enable downstream intrusions into enterprise networks that trust these providers.

Threat Actor / Malware Profile

Operation C-Major — PATCHCORD / SHEETCORD Cluster

• Distribution: Spear-phishing and watering-hole delivery of trojanized installers — fake VPN clients impersonating Afghan Telecom and counterfeit telecom network-management utilities. Lures are sector-tuned, suggesting reconnaissance-driven targeting.
• Payload behavior: PATCHCORD is a custom C/C++ backdoor providing remote command execution, file staging, and secondary payload delivery. It acts as the initial foothold for deploying ValleyRAT, GateSentinel, and the HackBrowserData credential stealer, which extracts stored logins, cookies, and autofill data from Chromium-based browsers.
• C2 communication: SHEETCORD, written in Go, uses legitimate Google Sheets documents as a dead-drop C2 channel — commands are written into spreadsheet cells and results exfiltrated back through the same document. This makes C2 traffic indistinguishable from normal Google Workspace API usage at the network layer. SuperShell provides supplementary interactive access; the HACKERAI C2 agent rounds out redundant channels. C2 infrastructure includes the domain appstoore.solutions.
• Persistence & privilege escalation: The pulse references CVE-2021-4034 (PwnKit, polkit pkexec) and CVE-2024-6387 (regreSSHion, OpenSSH), indicating Linux privilege-escalation and lateral-movement capability against telecom backend infrastructure.
• Anti-analysis: Multi-implant redundancy, living-off-trusted-SaaS C2, and sector-specific lure packaging designed to survive casual sandbox detonation.

Evooo1Bot — Linux Botnet

• Distribution: Exploitation of Internet-facing edge and IoT devices via a built-in exploit arsenal (8+ CVEs spanning routers, cameras, and WAF appliances) plus SSH brute-force scanning.
• Payload behavior: Mirai-derived DDoS engine extended with SOCKS5 relay (turning victims into proxy nodes for criminal traffic), credential sniffing on compromised interfaces, and self-propagation.
• C2 communication: Encrypted C2 channel protected by multi-layer string encryption using AES-256-CBC, hampering static analysis and signature development.
• Persistence: Standard Mirai-family techniques — init/rc script modification and watchdog processes on embedded devices.

IOC Analysis

The pulses contain three operational indicator classes:

• CVE identifiers (10 total): These are exploitation and privilege-escalation indicators, not network IOCs. They map directly to your external attack surface and Linux server estate. CVE-2024-6387 and CVE-2021-4034 (PATCHCORD cluster) plus the Evooo1Bot edge-device CVE set should be reconciled against vulnerability scan results immediately — any unpatched, Internet-exposed instance is a live target.
• Domain (1): appstoore.solutions — PATCHCORD cluster C2/staging infrastructure. Block at DNS, proxy, and EDR network layers; retro-search DNS and proxy logs for 90 days.
• File hashes (MD5/SHA1/SHA256): Implant samples for PATCHCORD/SHEETCORD tooling. Import into your EDR blocklist and retro-hunt across endpoint telemetry. SHA256 values are the durable artifacts — MD5/SHA1 are provided for cross-referencing with sandbox reports.

Note what is absent: no static C2 IPs for SHEETCORD, because its C2 is Google Sheets. Detection for this implant must be behavioral (process-to-Google-API anomalies) rather than indicator-based — see Detection Engineering below.

Detection Engineering

---
title: Suspicious Process Communication with Google Sheets API
description: Detects non-browser processes communicating with Google Sheets/Docs API endpoints, consistent with SHEETCORD (Operation C-Major) using Google Sheets as a dead-drop C2 channel.
logsource:
  category: network_connection
  product: windows
status: experimental
date: 2026/09/12
author: Security Arsenal Threat Intelligence
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'sheets.googleapis.com'
      - 'docs.google.com'
      - 'googleapis.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\googledrivesync.exe'
  filter_office:
    Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\teams.exe'
  condition: selection_dest and not 1 of filter_*
falsepositives:
  - Legitimate line-of-business tools integrating with Google Workspace APIs
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1102.002
---
title: HackBrowserData Browser Credential Theft Execution
description: Detects execution of HackBrowserData or suspicious processes accessing browser Login Data / Cookies stores, associated with the PATCHCORD cluster's credential harvesting stage.
logsource:
  category: process_creation
  product: windows
status: experimental
date: 2026/09/12
author: Security Arsenal Threat Intelligence
detection:
  selection_name:
    Image|contains:
      - 'hackbrowserdata'
  selection_cmd:
    CommandLine|contains:
      - 'Login Data'
      - 'Cookies'
      - 'Web Data'
      - 'Local State'
      - '--browser'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_name or (selection_cmd and not filter_browsers)
falsepositives:
  - Legitimate enterprise browser forensics or migration tooling
level: critical
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1555.003
---
title: Linux Credential Sniffing and SSH Brute-Force — Evooo1Bot Behavior
description: Detects process execution patterns consistent with Evooo1Bot on Linux — raw socket packet capture tooling spawned from unusual parents, mass SSH connection attempts, and Mirai-style watchdog persistence.
logsource:
  category: process_creation
  product: linux
status: experimental
date: 2026/09/12
author: Security Arsenal Threat Intelligence
detection:
  selection_ssh:
    CommandLine|contains:
      - 'hydra'
      - 'medusa'
      - 'sshpass'
  selection_sniff:
    CommandLine|contains:
      - 'tcpdump'
      - 'ifconfig eth0 promisc'
      - 'SOCK_RAW'
  selection_persist:
    CommandLine|contains:
      - '/etc/rc.local'
      - '/etc/init.d/'
      - 'crontab'
  condition: 1 of selection_*
falsepositives:
  - Authorized penetration testing, network administration
level: medium
tags:
  - attack.credential_access
  - attack.t1040
  - attack.t1110
  - attack.persistence

// Operation C-Major & Evooo1Bot hunt — C2, delivery, and credential theft artifacts
let ioc_domains = dynamic(["appstoore.solutions"]);
let ioc_hashes = dynamic([
  "0f4073d3c866bc3daf55b25f71250b96ec120db94a4f9cc8fe85b7c9f9d346b3",
  "1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94",
  "2323b55ea743c813e48689318e8ed54ae838cf9e8a2adbfc2488ea8a36dd0126"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where Timestamp > ago(90d)
   | where RemoteUrl has_any (ioc_domains)),
  (DeviceProcessEvents
   | where Timestamp > ago(90d)
   | where SHA256 has_any (ioc_hashes) or InitiatingProcessSHA256 has_any (ioc_hashes)),
  (DeviceNetworkEvents
   | where Timestamp > ago(7d)
   | where RemoteUrl has_any ("sheets.googleapis.com", "docs.google.com")
   | where not (FileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","winword.exe","excel.exe","outlook.exe","teams.exe"))
   | project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP),
  (DeviceFileEvents
   | where Timestamp > ago(7d)
   | where FolderPath has_any ("\\Login Data", "\\Cookies", "\\Web Data")
   | where not (FileName in~ ("chrome.exe","msedge.exe","firefox.exe"))
   | project Timestamp, DeviceName, FileName, FolderPath, ActionType)

#!/bin/bash
# Security Arsenal — Linux hunt for Evooo1Bot & PATCHCORD-cluster artifacts
# Run via EDR live-response or configuration management across the Linux estate.

REPORT="otx_hunt_$(hostname)_$(date +%Y%m%d).txt"
echo "=== OTX Pulse Hunt: Evooo1Bot / Operation C-Major ===" > "$REPORT"

# 1. Check for PATCHCORD cluster file hashes (SHA256)
echo -e "\n[+] Hash sweep in common staging dirs..." >> "$REPORT"
HASHES="0f4073d3c866bc3daf55b25f71250b96ec120db94a4f9cc8fe85b7c9f9d346b3
1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94
2323b55ea743c813e48689318e8ed54ae838cf9e8a2adbfc2488ea8a36dd0126"
find /tmp /var/tmp /dev/shm /opt /home -type f -size +10k 2>/dev/null | while read -r f; do
  h=$(sha256sum "$f" 2>/dev/null | awk '{print $1}')
  echo "$HASHES" | grep -q "$h" && echo "[!] HASH MATCH: $f ($h)" >> "$REPORT"
done

# 2. Evooo1Bot persistence artifacts — Mirai-style init/cron hooks
echo -e "\n[+] Persistence check (rc.local, init.d, cron)..." >> "$REPORT"
grep -Ei 'evooo|/tmp/|/dev/shm/|wget|curl.*\|' /etc/rc.local /etc/init.d/* /etc/crontab /var/spool/cron/* 2>/dev/null >> "$REPORT"

# 3. Suspicious outbound connections (C2, SOCKS relay, SSH scanning)
echo -e "\n[+] Active suspicious connections..." >> "$REPORT"
ss -tunp 2>/dev/null | grep -Ei 'ESTAB' | grep -Eiv 'sshd|systemd|nginx|apache|chrony' >> "$REPORT"

# 4. Promiscuous interfaces (credential sniffing indicator)
echo -e "\n[+] Promiscuous mode interfaces..." >> "$REPORT"
ip link show | grep -i promisc >> "$REPORT"

# 5. Vulnerability posture — pulse-referenced CVEs
echo -e "\n[+] Vulnerability posture (pulse CVEs)..." >> "$REPORT"
# CVE-2021-4034 (PwnKit): patched polkit has pkexec >= 0.120
pkexec --version 2>/dev/null >> "$REPORT"
# CVE-2024-6387 (regreSSHion): vulnerable OpenSSH 8.5p1-9.7p1
ssh -V 2>&1 >> "$REPORT"

# 6. Known-bad domain resolution attempts in resolver cache/logs
echo -e "\n[+] C2 domain check..." >> "$REPORT"
grep -ri "appstoore.solutions" /var/log/ 2>/dev/null | head -20 >> "$REPORT"

echo "=== Hunt complete. Review $REPORT for [!] markers. ==="
cat "$REPORT"

Response Priorities

Immediate (0–4 hours):

• Block appstoore.solutions at DNS, web proxy, and EDR network control layers; import all SHA256 hashes into EDR blocklists and retro-hunt 90 days of execution telemetry.
• Alert on any non-browser process communicating with sheets.googleapis.com or docs.google.com — this is the highest-fidelity SHEETCORD signal available.
• Run the Linux hunt script against telecom-adjacent, Internet-facing, and SSH-exposed Linux hosts.

Within 24 hours:

• Because both campaigns perform credential theft (HackBrowserData browser-stealing; Evooo1Bot credential sniffing and SSH brute-force), force password resets for any user whose endpoint shows browser credential-store access anomalies, and rotate SSH keys/credentials on any host with promiscuous-mode or sniffing indicators.
• Audit authentication logs for impossible-travel and credential-stuffing patterns; assume harvested credentials are already enumerated on dark web markets.
• Verify MFA coverage on VPN, remote access, and cloud identity — with special attention to accounts used by telecom/network operations staff.

Within 1 week:

• Patch or mitigate every pulse-referenced CVE on exposed assets: OpenSSH (CVE-2024-6387), polkit (CVE-2021-4034), and the Evooo1Bot edge-device set (CVE-2021-36260, CVE-2022-29464, CVE-2021-46422, CVE-2016-6277, CVE-2007-3010, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987).
• Segment edge/IoT devices away from credential-bearing infrastructure; disable Telnet and enforce SSH key-only auth with rate limiting.
• Implement SaaS API egress monitoring — Google Workspace C2 abuse is only detectable through behavioral baselining, not blocklists.
• Deploy fake-installer user awareness to telecom/NOC teams, as lures impersonate their own tooling.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub