TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Zscaler ThreatLabz has detailed a multi-stage cyber campaign by an East Asia-linked threat actor targeting Middle East governments using three new malware families: TELESHIM, MIXEDKEY, and BINDCLOAK.
Intelligence analysis by Llama
ThreatLabz documents a fresh espionage campaign hitting Middle East government entities. TELESHIM, a Windows backdoor, abuses the Telegram API for command-and-control to blend in with normal traffic, while MIXEDKEY and BINDCLOAK extend the intrusions with heavy obfuscation and target-locked payloads.
Imagine a spy who hides his walkie-talkie inside a normal radio station, so nobody notices when he talks. That's what TELESHIM does with Telegram, using a popular chat app to secretly send instructions to hacked computers in Middle East government offices. The attackers built three sneaky programs that unlock each other in order, and the final one only works on the exact computer they picked.
Analysis
Living off the chat app
The headline technical choice in this campaign is operational, not flashy. By tunneling command-and-control through Telegram's HTTP API, TELESHIM turns one of the world's most common messaging platforms into a covert channel. From a network defender's perspective, traffic to telegram.org looks routine, and any IP-blocking strategy that targets unfamiliar domains becomes useless against the operator's control plane. The malware registers the infected host by sending the host's MAC address, then accepts either control messages (run a command, return the output in 1,000-byte chunks) or download-and-execute messages that drop secondary payloads as scheduled tasks. The result is a backdoor that quietly piggybacks on infrastructure that virtually every office already permits.
Three-stage chain built to frustrate analysts
Zscaler's write-up walks through a chain designed to be hard to detonate and harder to reverse. Stage one is TELESHIM itself, a 32-bit Windows backdoor side-loaded via a legitimate executable ("RegSchdTask.exe") and a rogue DLL ("AsTaskSched.dll") packaged in an ISO file. Stage two is MIXEDKEY, a reflective loader shipped through a second DLL side-load ("pthreadVC2.dll") that decrypts an encrypted blob ("C99F29AC08454855B3D538960BB2F34F.PCPKEY"). Both stages lean on heavy string encryption, control flow flattening, mixed boolean arithmetic, and opaque predicates, and TELESHIM additionally probes for CPUID-based hypervisor artifacts and WMI-based RAM checks before running. The final payload is wrapped in two layers of XOR, the second derived from the infected machine's volume serial number via environmental keying, so the malware will only execute on the specific victim the operators intended.
Geofenced, timed, and not yet attributed
The post-compromise tradecraft is unusually disciplined. ThreatLabz observed the C2 operator executing reconnaissance and delivery commands almost exclusively between 7 and 11 July 2026, and only in the window of 4 a.m. to noon UTC, a schedule that fits an East Asian workday. The actor's Windows server locale, public IP geolocation, and operational tempo together support a moderate-to-high confidence attribution to an East Asian adversary, but the firm has stopped short of naming a known APT group. The final stage implant, BINDCLOAK, is a 64-bit C++ C2 agent reaching out to cert.hypersnet[.]com and following the same operational rhythm. For Middle East government defenders, the campaign is a reminder that the next intrusion is unlikely to announce itself on an unusual port; it will probably look like another chat app connection until someone bothers to look twice.
Key points
- Zscaler ThreatLabz attributes a new campaign targeting Middle East governments to an East Asia-linked threat actor, though no known APT group has been named.
- TELESHIM is a 32-bit Windows backdoor that abuses the Telegram API for command-and-control, blending malicious traffic with legitimate internet use.
- The attack chain uses two DLL side-loading stages to deliver a reflective loader (MIXEDKEY) and a 64-bit C++ implant (BINDCLOAK).
- The final payload is double-XOR encrypted with environmental keying tied to the victim's volume serial number, restricting execution to intended targets.
- Active C2 commands were observed between July 7 and July 9, 2026, with activity concentrated between 4 a.m. and noon UTC.
Public disclosure by Zscaler ThreatLabz gives Middle East government CERTs and enterprise defenders a concrete IOC set, including the BINDCLOAK C2 domain and the TELESHIM/MIXEDKEY side-load filenames, to hunt across historical telemetry. Greater visibility into Telegram-as-C2 abuse may also nudge defenders toward application-layer controls that block bot traffic regardless of the destination domain.
Environmental keying means the final payload is effectively invisible to anyone who is not the intended target, so most victims may never see BINDCLOAK detonate on their systems. The use of Telegram as a C2 transport also dramatically raises the operational cost of network-layer blocks, and the operator's disciplined 4 a.m.–noon UTC window suggests a patient adversary likely to regroup and retool after this exposure.
