Cybersecurity researchers said a threat actor tied to East Asia targeted government entities in the Middle East in a campaign detected earlier this month, using previously unreported malware families and Telegram for command and control.
KEY FACTS
- Targets Government entities in the Middle East
- Malware New families named TELESHIM, MIXEDKEY and BINDCLOAK
- C2 method TELESHIM used the Telegram API to blend in with normal traffic
- Timing Post-compromise activity was seen between July 7 and July 9, 2026
In a technical analysis, Zscaler ThreatLabz said the attack began with an ISO file that contained a legitimate executable, RegSchdTask.exe, used to sideload a rogue DLL named AsTaskSched.dll. That DLL acted as a 32-bit backdoor called TELESHIM.
TELESHIM then used Telegram as its command and control channel to fetch next-stage components. Two of those payloads triggered a second DLL sideloading chain that used GoProAlertService.exe and pthreadVC2.dll, with the latter acting as a reflective loader named MIXEDKEY.
The report said MIXEDKEY decrypted and executed the contents of a file named C99F29AC08454855B3D538960BB2F34F.PCPKEY. Both TELESHIM and MIXEDKEY used string encryption, control flow flattening, mixed boolean arithmetic and opaque predicates, while TELESHIM also checked for virtualized analysis environments.
The final payload was protected by two layers of XOR encryption, including environmental keying tied to the infected machine’s volume serial number. The campaign ended with BINDCLOAK, a 64-bit C2 implant written in C++ that connected to an external server.
ThreatLabz said it observed post-compromise reconnaissance and next-stage payload delivery, with C2 commands run mainly between 4 a.m. and 12 p.m. UTC. Based on the operator’s public IP address, Windows locale, geolocation and working hours, the activity was assessed with moderate-to-high confidence as originating from East Asia, though it has not been linked to a known group.
WHY IT MATTERS
The campaign shows how attackers are using trusted services such as Telegram to hide malicious traffic and how layered obfuscation can slow analysis. It also highlights the continued use of DLL sideloading and environment-specific payloads to limit detection and control where malware runs.