TELESHIM/MIXEDKEY/BINDCLOAK: Unattributed East Asian Threat Actor Targets Middle East Government Entities via DLL Sideloading and Telegram C2
TELESHIM/MIXEDKEY/BINDCLOAK (TL-2026-1562), also tracked as TELESHIM Campaign, is a high-severity malware campaign, first published 2026-07-20 and last reviewed 2026-07-28. It is attributed to MIXEDKEY with medium confidence, affects Microsoft Windows (unspecified versions supporting scheduled tasks, maps to 31 MITRE ATT&CK techniques (T1005, T1012, T1016), and is covered by 9 detection rules and 42 indicators of compromise.
Key facts for TL-2026-1562
- Threat ID
- TL-2026-1562
- Also known as
- TELESHIM Campaign, MIXEDKEY/BINDCLOAK Intrusion Set
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-28
- Attribution
- MIXEDKEY
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- government administration
- Target regions
- Middle East
- Detection rules
- 9
- Indicators of compromise
- 42
- Updates
- 2026-07-28 · revalidated 1× · latest source
Malware and tooling in TELESHIM/MIXEDKEY/BINDCLOAK
Malware and tooling: BINDCLOAK, MIXEDKEY, TELESHIM, Telegram Bot API
Zscaler ThreatLabz documents a targeted intrusion campaign against Middle East government entities by an unattributed, moderate-to-high confidence East Asian threat actor. The campaign chains a spear-phished ISO lure, DLL-sideloaded TELESHIM Telegram-based backdoor, MIXEDKEY reflective loader, and BINDCLOAK C2 implant, protected by heavy control-flow-flattening/MBA obfuscation and sandbox evasion.
How TELESHIM/MIXEDKEY/BINDCLOAK works
In early-to-mid July 2026, Zscaler ThreatLabz identified a targeted intrusion campaign against government entities in the Middle East, attributed with moderate-to-high confidence to an East Asian threat actor based on public IP geolocation, system locale configuration, and operational hours (4 AM-12 PM UTC, concentrated 7-11 AM UTC). The actor is not attributed to any known APT group at time of publication.
Initial access is achieved via spear-phishing with an ISO attachment themed as a 'Cooperation protocol for the exploration of petroleum and gas' (English), a geopolitically-tailored lure consistent with government/energy-sector targeting in the Middle East. The ISO contains a legitimate ASUSTek binary (RegSchdTask.exe) alongside a malicious sideloaded DLL (AsTaskSched.dll), which is the TELESHIM first-stage backdoor.
TELESHIM is a 32-bit C++ DLL compiled in July 2026 for this campaign (with earlier variants dating to 2025), protected by control-flow flattening, mixed boolean arithmetic (MBA), and opaque predicates. It encrypts strings using two separate schemes: per-function XOR keys, and Base64 encoding layered with a 44-byte rolling XOR key. TELESHIM installs a 7-byte inline hook at offset 0x1394 in the host executable, stages follow-on payloads to C:\programdata\shimgen_Data\, fingerprints the host via MAC address (GetAdaptersInfo), and communicates over a Telegram bot API C2 channel (api.telegram.org/bot/getUpdates) using a spoofed legacy Safari/WebKit User-Agent string. It establishes persistence via a scheduled task named 'shimgen' that re-executes every 6 minutes from C:\programdata\shimgen_Data\shimgen.exe, and uses the mutex '_----WebKitFormBoundary7MA4YWxkTrZu0g' to prevent multiple concurrent instances. Telegram C2 traffic is validated by chat-ID checking to prevent channel hijacking, and supports both direct control commands and download-and-execute operations.
A secondary DLL sideloading chain delivers MIXEDKEY, a 64-bit reflective loader, via a renamed GoPro-signed binary sideloading pthreadVC2.dll (accompanied by legitimate MSVCP120.dll/MSVCR120.dll runtime libraries), persisted through a second scheduled task named 'Feedback' running every 10 minutes. MIXEDKEY is heavily obfuscated (~1,000 MBA instructions per byte computed) and uses environmental keying tied to the infected host's volume serial number: it queries the 4-byte serial via GetVolumeInformationA, repeats it 5 times to derive a 20-byte rolling XOR key, then uses the first 311 bytes of an encrypted payload file as a second rolling XOR key to decrypt and reflectively load the next stage in memory, stripping the embedded 'MZ' PE signature and a size-prefix header in the process. The final payload is stored at C:\ProgramData\Crypto\DSS\C99F29AC08454855B3D538960BB2F34F.PCPKEY.
BINDCLOAK is the final-stage 64-bit C2 implant reflectively loaded by MIXEDKEY, communicating with the hardcoded domain cert.hypersnet[.]com; Zscaler deferred detailed protocol/capability analysis to a Part 2 report not yet published at time of writing.
The malware chain incorporates multiple anti-analysis and anti-sandbox techniques: a CPUID-based hypervisor detection check (EAX=1, bit 31 of ECX), an I/O-stall routine performing 1,000 iterations of ~1MB read/write against a temp file (%TEMP%\CVR9EEA.tmp) to detect accelerated sandbox clocks, and a WMI-based memory-speed check ('wmic memorychip get speed') that terminates execution if the value returns 0 or undefined (a common indicator of virtualized/sandboxed memory).
Post-compromise, the operator issued interactive reconnaissance commands consistent with hands-on-keyboard activity during observed operational hours of July 7-9, 2026: local account enumeration (net user), process listing (tasklist), hostname collection, network configuration and DNS cache dumps (ipconfig /all, ipconfig /displaydns), active connection enumeration (netstat -ano), directory listings of C:\Users and C:\ProgramData subdirectories, scheduled task verification (schtasks /Query), and network connectivity tests (ping). This reconnaissance pattern indicates the actor was actively validating persistence and profiling the compromised government host for follow-on operations rather than running fully automated tooling.
Additional reconnaissance-related domains observed in the campaign infrastructure include ssl.blsouqs[.]com and contacts.ftabnews[.]com, both patterned as regionally-themed lookalike domains targeting Middle East victims.
MITRE ATT&CK techniques used in TL-2026-1562
Collection
Discovery
T1012 Query Registry; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution; T1569 System Services
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel
Initial Access
stealth
Resource Development
Affected products and versions in TELESHIM/MIXEDKEY/BINDCLOAK
- Microsoft — Windows (unspecified versions supporting scheduled tasks, WMI, GetAdaptersInfo/GetVolumeInformationA APIs)
Vulnerable versions: Windows 10; Windows 11; Windows Server (general)
Remediation for TELESHIM/MIXEDKEY/BINDCLOAK
Immediate actions
- Block network indicators cert.hypersnet[.]com, ssl.blsouqs[.]com, and contacts.ftabnews[.]com at DNS/proxy/firewall layers
- Hunt for scheduled tasks named 'shimgen' and 'Feedback' across the environment
- Hunt for files at C:\programdata\shimgen_Data\, C:\ProgramData\Crypto\DSS\, and mutex '_----WebKitFormBoundary7MA4YWxkTrZu0g'
- Block/alert on Telegram bot API traffic (api.telegram.org) originating from servers or endpoints with no legitimate business need for Telegram
- Quarantine and hash-match any ISO attachments referencing 'Cooperation protocol for the exploration of petroleum and gas'
- Isolate and forensically image any host matching the AsTaskSched.dll, pthreadVC2.dll, or PCPKEY payload hashes
Workarounds
- Block mounting/execution of ISO/IMG email attachments at the mail gateway for government and high-value targets
- Restrict scheduled task creation privileges for standard users and alert on new task creation with sub-15-minute run intervals
Longer-term hardening
- Deploy application allowlisting / code-signing enforcement to prevent unsigned or mismatched DLLs from loading alongside signed vendor executables (ASUSTek, GoPro)
- Implement EDR rules to detect DLL sideloading (unsigned DLL loaded from a directory alongside a signed, unrelated-vendor executable)
- Deploy behavioral detection for anti-sandbox techniques (CPUID hypervisor bit checks, WMI memorychip speed queries, sustained temp-file I/O loops)
- Restrict or monitor outbound connections to messaging-platform APIs (Telegram, Discord, Slack) used as C2 channels from server/workstation fleets
- Deploy network egress monitoring for spoofed legacy User-Agent strings inconsistent with installed browser base
Weaknesses (CWE) in TELESHIM/MIXEDKEY/BINDCLOAK
CWE-427
Timeline of TELESHIM/MIXEDKEY/BINDCLOAK
- First of two earlier TELESHIM variants observed compiled during 2025, predating this campaign's operational use and establishing the malware family's development lineage
- Second earlier TELESHIM variant compiled during 2025, showing continued iteration on the backdoor prior to the July 2026 campaign-specific build
- Zscaler ThreatLabz first observes new activity by the East Asia-linked threat actor targeting Middle East government entities, ahead of the confirmed July 7-9 post-compromise session
- Campaign-specific TELESHIM variant (AsTaskSched.dll) compiled in July 2026 for use in the Middle East government intrusion
- Active post-compromise C2 operations against Middle East government targets begin, with operator issuing hands-on-keyboard reconnaissance commands
- Operator activity concentrates most heavily between 7 AM and 11 AM UTC, the narrowest observed C2 command-execution band within the broader 4 AM-12 PM UTC window
- Continued operational activity within the observed 4 AM-12 PM UTC window
- Observed post-compromise operational activity concludes for this intrusion window
- Threat ingested into TL-Intel harness via RSS hunt against Zscaler ThreatLabz feed
- Zscaler ThreatLabz publishes Part 1 of the campaign analysis, disclosing TELESHIM, MIXEDKEY, and initial infection chain details; BINDCLOAK deep-dive deferred to Part 2
- CyberPress and Security Boulevard publish additional independent summaries of the Zscaler ThreatLabz research.
- GBHackers on Security and Cyber Security News independently publish technical write-ups summarizing the Zscaler ThreatLabz research.
- The Hacker News publishes coverage of the campaign, bringing it to broad public and industry attention.
Update history for TL-2026-1562
- 2026-07-28 — TELESHIM: Telegram-based Windows Backdoor Targets Middle East Governments via DLL Sideloading: What changed No escalation to severity/exploitability applied — the newer report actually characterizes exploitability as NONE and severity as MEDIUM versus the existing ACTIVE/HIGH record; per escalation-only rules this is not applied, and
Sources cited for TELESHIM/MIXEDKEY/BINDCLOAK
Threats related to TELESHIM/MIXEDKEY/BINDCLOAK
- TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses Telegram Bot API for C2 Against Middle East Governments
- BINDCLOAK Backdoor Campaign Targeting Middle East Government Entities
- BINDCLOAK: Previously Undocumented 64-bit Modular Windows Backdoor Stealing User/Process Tokens for Privilege Escalation
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- OctLurk and SilkLurk Backdoors: Unattributed Chinese-Speaking Actor Cyberespionage Campaign Targeting Central Asian Government and Critical Infrastructure
- Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military
Detection coverage for TL-2026-1562
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1562 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.