Zscaler ThreatLabz has published a two-part technical breakdown of a fresh intrusion set targeting government entities in the Middle East, attributed to a threat actor with ties to East Asia. The campaign introduces three previously undocumented malware families — TELESHIM, MIXEDKEY, and BINDCLOAK — built around an unusual choice for command-and-control: the public Telegram Bot API.

What happened

Post-compromise activity captured by ThreatLabz traces back to a weaponized ISO file delivered to victims. Inside the ISO sits a legitimate, ASUS-signed binary, RegSchdTask.exe, which the attackers abuse as a DLL side-loading vector to load a malicious library, AsTaskSched.dll. Because the host process is a trusted, signed executable, this sideloading step lets the first-stage payload — TELESHIM — execute inside a process that most endpoint controls and analysts would wave through.

TELESHIM is a 32-bit C++ Windows DLL, compiled as recently as July 2026, that installs an API hook in its host process at startup so its own code runs disguised as the legitimate application. From there it uses the Telegram Bot API — parsed with the open-source nlohmann/json library — to receive commands and exfiltrate data, blending its traffic into ordinary HTTPS calls to Telegram’s infrastructure rather than a bespoke C2 domain that network defenders could more easily flag.

Technical details

The toolset is notably well-engineered for anti-analysis. TELESHIM and its companion MIXEDKEY both use control-flow flattening, mixed boolean arithmetic, and opaque predicates to resist reverse engineering, and TELESHIM checks for hypervisor presence via the CPUID instruction and validates installed RAM through WMI queries — refusing to run in virtualized sandboxes. Commands received over Telegram are validated against the victim machine’s MAC address before execution, so stolen or replayed command traffic won’t fire against the wrong host. Command output and exfiltrated data are encrypted and chunked before being sent back over the same Telegram channel.

The third component, BINDCLOAK, goes a step further on environmental keying: it’s encrypted with a key derived from the infected machine’s volume serial number, meaning the payload only decrypts correctly on the specific machine it was deployed to — a copy pulled off that host and analyzed elsewhere is just ciphertext. ThreatLabz’s Part 2 analysis covers BINDCLOAK’s role in the chain in more depth; Part 1 focuses on TELESHIM and MIXEDKEY.

Impact

There’s no CVE here — this is a targeted espionage toolset relying on social engineering (the ISO lure) and trusted-binary abuse rather than a software vulnerability, so it won’t show up in a vulnerability scanner. The targets are government entities in the Middle East, and the tradecraft — DLL sideloading off a signed binary, hypervisor-aware anti-sandbox checks, per-victim key derivation, and C2 hidden inside a legitimate consumer messaging platform — points to a well-resourced, patient operator rather than opportunistic crimeware. Using Telegram as a C2 channel is a deliberate evasion choice: egress filtering and reputation-based blocking that would catch a raw C2 domain typically wave through Telegram’s API endpoints as legitimate SaaS traffic.

Mitigation

  • Block or tightly control unauthorized outbound traffic to Telegram’s Bot API domains (api.telegram.org) from servers and workstations that have no legitimate business reason to reach it; alert on unexpected processes making these calls.
  • Treat ISO/IMG file attachments and downloads as a high-risk lure category — Windows mounts them without a Mark-of-the-Web prompt in many configurations, which is precisely why they remain popular delivery vehicles.
  • Hunt for DLL sideloading against signed, trusted binaries (ASUS or otherwise) rather than relying on code-signing checks alone; monitor for signed executables loading DLLs from non-standard install paths.
  • Apply YARA/behavioral detections for control-flow-flattened binaries with CPUID-based hypervisor checks and WMI RAM queries as a heuristic for anti-sandbox malware, since these are reusable indicators independent of this specific family.
  • Government and public-sector security teams in the Middle East region should treat this as an active, ongoing campaign and review egress logs for Telegram API traffic from unmanaged or unexpected hosts.

References: Zscaler ThreatLabz: Targeted Attack on Government Entities in the Middle East, Part 1, The Hacker News: TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments, CyberPress: New TELESHIM Malware Uses Telegram Bots to Backdoor Middle East Government Systems