TELESHIM Malware Uses Telegram API for Command-and-Control in Attacks Against Middle East Government Entities

Severity
Medium

Detail

Cybersecurity researchers at Zscaler ThreatLabz have identified a targeted cyber espionage campaign against government entities in the Middle East. The campaign deploys three previously undocumented malware families, TELESHIM, MIXEDKEY, and BINDCLOAK, through a multi-stage infection chain designed to establish persistent access on compromised systems.

The attackers abuse the Telegram API as a command-and-control (C2) communication channel, allowing malicious traffic to blend with legitimate internet activity and making detection more challenging. Based on infrastructure analysis, operational patterns, and system configurations, Zscaler assesses with moderate-to-high confidence that the activity originates from an East Asia-based threat actor, although no known threat group has been formally attributed.

How?

The attack begins with the delivery of an ISO file containing a legitimate executable (RegSchdTask.exe) and a malicious DLL (AsTaskSched.dll). The legitimate executable performs DLL sideloading to load TELESHIM, a 32-bit Windows backdoor.

Once executed, TELESHIM communicates with the attacker through the Telegram API to register the infected host, receive commands, and download additional payloads. It also performs virtualization and sandbox detection using techniques such as CPUID hypervisor checks and Windows Management Instrumentation (WMI)-based RAM speed verification to evade analysis.

TELESHIM downloads additional components that initiate a second DLL sideloading sequence using GoProAlertService.exe and a malicious pthreadVC2.dll. The DLL functions as a reflective loader named MIXEDKEY, which decrypts and executes an encrypted payload stored in a .PCPKEY file.

Both TELESHIM and MIXEDKEY employ advanced obfuscation techniques, including string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to hinder reverse engineering.

The final payload, BINDCLOAK, is protected by two layers of XOR encryption, with the second layer using environmental keying derived from the infected system’s volume serial number. This ensures the malware executes only on intended target systems before establishing communication with its external C2 server.

Impact

The attackers performed post-compromise activities including system, user, and network reconnaissance, followed by the deployment of additional malware payloads. Most observed activity occurred between July 7 and July 9, 2026, with command execution primarily taking place between 4:00 a.m. and 12:00 p.m. UTC.

The campaign demonstrates several advanced defense evasion techniques, including abuse of trusted cloud services for C2 communications, extensive code obfuscation, DLL sideloading, environmental keying, and anti-analysis capabilities. These techniques enable the malware to evade endpoint detection solutions, complicate forensic analysis, and limit execution to intended victims.

Recommendation

Organizations should:

• Monitor for unusual use of the Telegram API and outbound connections to messaging services from endpoints that do not normally require such communications.
• Detect and investigate DLL sideloading attempts involving legitimate signed executables loading unexpected DLL files.
• Monitor for the creation of scheduled tasks and the execution of unsigned or unexpected binaries from temporary or user-accessible directories.
• Deploy Endpoint Detection and Response (EDR) solutions capable of identifying reflective DLL loading, process injection, and code obfuscation techniques.
• Monitor for reconnaissance activities, including abnormal system, user, and network discovery commands executed after initial compromise.
• Keep endpoint security solutions updated and conduct threat hunting using indicators of compromise (IOCs) published by Zscaler ThreatLabz.

Conclusion

The TELESHIM campaign demonstrates a sophisticated cyber espionage operation targeting government organizations in the Middle East through a multi-stage malware framework. By abusing Telegram for command-and-control communications, employing DLL sideloading, advanced code obfuscation, environmental keying, and anti-analysis techniques, the attackers significantly increase the difficulty of detection and analysis. The campaign highlights the growing trend of leveraging trusted online services to conceal malicious communications and reinforces the need for behavioral detection, endpoint monitoring, and proactive threat hunting to identify complex attack chains.

Source

https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html