TELESHIM Abuses C2’s Telegram In Attacks Against Middle Eastern Governments
Cybersecurity researchers have flagged new dangerous cyber activity by a threat actor with ties to East Asia targeting government agencies in the Middle East.
This intrusion resulted in the deployment of previously unreported malware families called TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity company said it discovered the campaign earlier this month.
“The campaign used a multi-stage attack chain to establish and maintain access to infected systems, TELESHIM misused the Telegraph API for communication and control and control (C2) to interact with legitimate Internet traffic,” said Sudeep Singh, senior research manager for APT at Zscaler ThreatLabz, in a statement published last week.
The attack chain starts with an ISO file containing a legitimate executable (“RegSchdTask.exe”) that is used to sideload a robust DLL (“AsTaskSched.dll”), a 32-bit Windows backdoor called TELESHIM that then uses Telegram as C2 to find components for the next stage.
Two of these payloads are used to trigger a second DLL sideloading chain consisting of “GoProAlertService.exe” and “pthreadVC2.dll,” with the latter acting as a light loader with code named MIXEDKEY to decrypt the contents of “C99F29AC08454855B3DPCY2PPE9” itself.
Both TELESHIM and MIXEDKEY were found to rely on heavy code obfuscation techniques, including string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and abstract predicates to prevent reverse engineering efforts. TELESHIM also uses multiple methods to detect the presence of optically based analysis sites. Some of them are listed below –
- Hypervisor discovery using CPUID
- Checking RAM speed using Windows Management Instrumentation (WMI)
TELESHIM C2 communication supports two types of messages –
- Control messages, used to register an infected host by sending the host’s MAC address and using received commands and output the results back to the server in chunks if the output is larger than 1,000 bytes.
- Download and use messages, which are used to download and use secondary payloads such as scheduled tasks
What is remarkable about the final payload is that it is locked behind two layers of XOR encryption, the second layer uses a technique called environmental keying by encoding it with a decryption key derived from the serial number of the infected machine’s volume. This is done so that the malware only explodes on the target.
The attack sequence culminates in the use of BINDCLOAK, a 64-bit C2 exploit written in C++ that affects an external server (“cert.hypersnet[.]com”).
ThreatLabz noted that it has identified post-compromise activity from the C2 operator, such as system, user, and network commands, as well as the delivery of next-stage payloads, most of which occurred between July 7, 2026 and July 9, 2026. The C2 commands were only executed between 2:00 and 7:00 am and 11 am UTC.
Based on the threat actor’s IP address, system location configured on their Windows server, IP address location, and active operating hours, it is assessed with medium to high confidence that the campaign is the work of an enemy from East Asia. It was not because of any currently known dangerous actor or group.
“This work also shows broader trends such as EDR evasion, interception of legitimate Internet traffic by abuse of trusted platforms, and the use of encryption techniques such as MBA and CFF to prevent engineering,” Singh said.
