Cybersecurity researchers have uncovered a new espionage campaign targeting government organizations in the Middle East, involving a previously undocumented malware toolkit designed to maintain long-term access while evading detection.
According to a recent report from Zscaler ThreatLabz, the campaign deploys three newly identified malware families—TELESHIM, MIXEDKEY, and BINDCLOAK—through a sophisticated, multi-stage infection chain. Researchers first detected the activity earlier this month.
Telegram Used as a Covert Command-and-Control Channel
One of the campaign’s standout techniques is the abuse of the Telegram API for command-and-control (C2) communications.
By routing malware traffic through Telegram, the attackers blend malicious activity with legitimate internet traffic, making it more difficult for security teams to identify suspicious communications.
According to Zscaler ThreatLabz, TELESHIM serves as the primary backdoor and uses Telegram to receive commands and download additional malware components.
Attack Begins with DLL Side-Loading
The infection starts with a malicious ISO file that contains a legitimate Windows executable named RegSchdTask.exe.
Attackers exploit DLL side-loading by pairing the executable with a malicious DLL called AsTaskSched.dll, allowing the rogue code to run under the guise of a trusted application.
Once executed, the DLL installs TELESHIM, a 32-bit Windows backdoor that establishes communication with the attackers through Telegram.
Multi-Stage Malware Deployment
After gaining an initial foothold, TELESHIM retrieves additional payloads that launch a second DLL side-loading sequence.
This stage uses:
- GoProAlertService.exe (legitimate executable)
- pthreadVC2.dll (malicious reflective loader)
The reflective loader, dubbed MIXEDKEY, decrypts and executes an encrypted payload stored in a file named:
C99F29AC08454855B3D538960BB2F34F.PCPKEY
This layered approach helps conceal malicious activity while making analysis significantly more difficult.
Heavy Obfuscation Hinders Analysis
Researchers found that both TELESHIM and MIXEDKEY employ multiple code obfuscation techniques designed to frustrate reverse engineering efforts.
These include:
- String encryption
- Control Flow Flattening (CFF)
- Mixed Boolean Arithmetic (MBA)
- Opaque predicates
TELESHIM also includes several anti-analysis capabilities that attempt to detect whether it is running inside a virtualized research environment.
Among the techniques observed were:
- Hypervisor detection using the CPUID instruction
- RAM speed checks via Windows Management Instrumentation (WMI)
TELESHIM Supports Multiple Command Types
The malware communicates with its operators using two primary message types.
Control Messages
These messages allow the malware to:
- Register infected devices by sending their MAC addresses
- Execute attacker-issued commands
- Exfiltrate collected data in smaller chunks when command output exceeds 1,000 bytes
Download-and-Execute Messages
These commands instruct the malware to retrieve additional payloads and execute them through scheduled Windows tasks.
Environmental Keying Limits Infection
Researchers discovered that the campaign employs an advanced encryption strategy to ensure the malware only executes on intended targets.
The final payload is protected by two layers of XOR encryption.
The second layer uses a technique known as environmental keying, where the decryption key is generated from the infected machine’s Windows volume serial number.
This means the payload can only be successfully decrypted and executed on specifically targeted systems, reducing the likelihood of accidental exposure during malware analysis.
Final Payload: BINDCLOAK
The attack concludes with the deployment of BINDCLOAK, a 64-bit C++ implant that communicates with an external command-and-control server.
Researchers observed the malware contacting:
cert.hypersnet[.]com
Once active, BINDCLOAK enables attackers to maintain persistent remote access to compromised systems.
Evidence of Hands-On Keyboard Activity
Zscaler ThreatLabz also identified evidence of direct attacker interaction following the initial compromise.
Between July 7 and July 9, 2026, operators executed numerous reconnaissance commands to gather information about compromised environments, including:
- System discovery
- User enumeration
- Network reconnaissance
- Deployment of additional payloads
Interestingly, the observed activity consistently occurred between 4:00 a.m. and 12:00 p.m. UTC, with the highest concentration of commands executed between 7:00 a.m. and 11:00 a.m. UTC.
Suspected East Asia Origin
Although the campaign has not yet been attributed to a known advanced persistent threat (APT) group, researchers believe it likely originated from East Asia.
This assessment is based on several indicators, including:
- Public IP address information
- Windows system locale settings
- Geolocation of attacker infrastructure
- Consistent operational working hours
Taken together, these indicators provide moderate-to-high confidence regarding the attackers’ regional origin.
Emerging Trends in Advanced Cyber Operations
The newly uncovered campaign highlights several techniques increasingly adopted by sophisticated threat actors.
These include:
- Abuse of trusted cloud platforms like Telegram for command-and-control communications
- Endpoint Detection and Response (EDR) evasion
- Multi-stage malware delivery
- DLL side-loading
- Extensive code obfuscation using Control Flow Flattening and Mixed Boolean Arithmetic
The combination of stealthy communication channels, anti-analysis mechanisms, and environment-specific payload execution demonstrates the growing sophistication of modern cyber-espionage operations targeting government networks.
Organizations, particularly within the public sector, should strengthen endpoint monitoring, restrict unauthorized DLL loading, monitor unusual Telegram-related network activity, and deploy layered detection capabilities capable of identifying advanced multi-stage attacks.
