TELESHIM Malware Abuses Telegram to Attack Middle East Governments
East Asia-linked hackers launched a new cyber attack by abusing the Telegram API.
1A New Cyber Threat Emerges
Zscaler ThreatLabz detected a new cyber campaign by an East Asia-linked threat actor targeting government entities in the Middle East. The campaign involves the distribution of new malware families named TELESHIM, MIXEDKEY, and BINDCLOAK. The attacks were detected in early July 2026. Researchers noted that the attack uses a multi-stage chain and abuses the Telegram API for command and control (C2) communication.
2Technical Details of the Attack
The attack chain begins with an ISO file containing a legitimate executable. This file is used to sideload a malicious DLL. The 32-bit Windows backdoor, TELESHIM, uses Telegram for C2 communication to retrieve next-stage components. A second DLL loading chain activates a reflective loader codenamed MIXEDKEY. This loader decrypts and executes the contents of an encrypted file.
3Code Obfuscation and Virtual Environment Detection
TELESHIM and MIXEDKEY use heavy code obfuscation techniques to hinder reverse engineering efforts. These techniques include string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates. TELESHIM also employs various methods to detect virtualization-based analysis environments. These techniques make the malware difficult to analyze.
4Double-Layered Encryption and Targeted Attack
The final payload is protected by two layers of XOR encryption. The second layer uses a technique called environmental keying, deriving the encryption key from the infected machine's volume serial number. This ensures the malware only runs on intended targets. This method indicates the attack is targeted and aimed at specific victims.
5BINDCLOAK: The Final Payload
The attack chain concludes with the deployment of BINDCLOAK, a 64-bit C2 implant written in C++. This implant communicates with an external server. Zscaler ThreatLabz detected the C2 operator using system, user, and network reconnaissance commands. Most of these activities occurred between July 7-9, 2026. Commands were executed between 4 a.m. and 12 p.m. UTC.
6Attacker's Origin and Motivation
The attacker's public IP address, system locale configuration, and IP geolocation suggest the campaign originates from East Asia. However, the attack has not been attributed to any known threat actor or group at this stage. The motivation behind the attack is believed to be data theft and espionage.
7Broader Trends and Security Measures
This activity reflects broader trends such as EDR evasion, abuse of trusted platforms, and code obfuscation techniques. Researchers emphasize that organizations should update security measures and monitor suspicious activities to protect against such attacks. Caution is advised against the abuse of platforms like Telegram.
8Conclusion and Recommendations
The TELESHIM campaign highlights the increasing complexity of cyber threats. Attackers abuse legitimate platforms to evade detection and carry out targeted attacks. Organizations should adopt proactive security measures and continuously monitor threat intelligence. Additionally, raising employees' cybersecurity awareness is critical.