TELESHIM abuses Telegram for C2 in attacks against Middle Eastern governments
Ravie LakshmananJuly 27, 2026Cyber Attack/Threat Intelligence
Cybersecurity researchers have detected new malicious cyber activity by a threat actor with ties to East Asia and targeting government entities in the Middle East.
The intrusions have led to the deployment of previously unreported malware families called TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.
“The campaign used a multi-stage attack chain to establish and maintain access to the infected systems, with TELESHIM abusing the Telegram API for command and control (C2) communication to blend in with legitimate Internet traffic,” Sudeep Singh, senior APT research manager at Zscaler ThreatLabz, said in a white paper published last week.
The attack chain begins with an ISO file containing a legitimate executable (“RegSchdTask.exe”) that is used to download a malicious DLL (“AsTaskSched.dll”), a 32-bit Windows backdoor called TELESHIM that then leverages Telegram as C2 to recover components for the next stage.
Two of these payloads are used to activate a second DLL sideload chain comprising “GoProAlertService.exe” and “pthreadVC2.dll”, with the latter acting as a reflective loader codenamed MIXEDKEY to decrypt the contents of “C99F29AC08454855B3D538960BB2F34F.PCPKEY” and execute it.
Both TELESHIM and MIXEDKEY have been found to rely on heavy code obfuscation techniques including string encryption, control flow flattening (CFF), mixed Boolean arithmetic (MBA), and opaque predicates to deter reverse engineering efforts. TELESHIM also employs a variety of methods to detect the presence of virtualization-based analytics environments. Some of these are listed below:
Hypervisor detection using CPUID Checking RAM speed using Windows Management Instrumentation (WMI)
TELESHIM C2 communications support two types of messages:
Control messages, used to register the infected host by sending the MAC address of the host and executing the received commands and exfiltrating the results to the server in chunks if the output exceeds 1000 bytes. Download and execute messages, which are used to download and execute secondary payloads such as scheduled tasks.
What is notable about the final payload is that it is locked behind two layers of XOR encryption, the second layer uses a technique called environmental key encrypting it using a decryption key derived from the serial number of the volume of the infected machine. This is done so that the malware detonates only on its intended targets.
The attack sequence culminates with the implementation of BINDCLOAK, a 64-bit C2 implant written in C++ that contacts an external server (“cert.hypersnet(.)com”).
ThreatLabz noted that it identified post-compromise activity from the C2 operator, such as system, user, and network reconnaissance commands, as well as the delivery of next-stage payloads, most of which occurred between July 7, 2026 and July 9, 2026. C2 commands were executed only between 4 a.m. and 12 p.m. UTC, with a large portion of the activity taking place between 7 a.m. and 11 a.m. UTC.
Based on the threat actor’s public IP address, system locale settings configured on their Windows server, IP address geolocation, and active operating hours, the campaign is assessed with moderate to high confidence to be the work of an adversary originating from East Asia. It has not been attributed to any known threat actors or groups at this time.
“The activity also reflects broader trends such as evasion of EDR, commingling with legitimate Internet traffic by abusing trusted platforms, and using code obfuscation techniques such as MBA and CFF to hinder reverse engineering,” Singh said.
