Threat reportMalwareTL-2026-1582
TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses Telegram Bot API for C2 Against Middle East Governments
TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses (TL-2026-1582), also tracked as TELESHIM Campaign, is a high-severity malware campaign, first published 2026-07-21. It has no confirmed attribution, affects Microsoft Windows (unspecified versions), maps to 27 MITRE ATT&CK techniques (T1001, T1008, T1016), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 27MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-1582
- Threat ID
- TL-2026-1582
- Also known as
- TELESHIM Campaign, MIXEDKEY Loader Campaign, BINDCLOAK Implant Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- government administration
- Target regions
- Middle East
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses
Malware and tooling: BINDCLOAK, MIXEDKEY, TELESHIM, Telegram Bot API (api.telegram.org)
How TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses works
A suspected East Asia-linked threat actor targeted Middle East government entities in a multi-stage intrusion (July 7-9, 2026) delivering the TELESHIM backdoor, MIXEDKEY reflective loader, and BINDCLOAK C2 implant. TELESHIM abuses the Telegram Bot API for encrypted HTTPS polling C2, validates commands against a victim's MAC address, and uses hypervisor/CPUID, WMI RAM, and I/O-stress anti-sandbox checks alongside control-flow-flattened and mixed-boolean-arithmetic obfuscation.
Zscaler ThreatLabz identified a previously undocumented, multi-stage malware campaign targeting Middle East government entities, assessed with moderate-to-high confidence as operated out of East Asia based on attacker IP geolocation, Windows locale configuration, and an operational window tightly bounded to 04:00-12:00 UTC (peak 07:00-11:00 UTC) during July 7-9, 2026.
Initial access is via a weaponized ISO disguised as diplomatic documents (e.g. 'Cooperation protocol for the exploration of petroleum and gas (English)' and 'Agreement on Common Border Offices (English)'), which contains a legitimate ASUSTek-signed executable (RegSchdTask.exe, renamed shimgen.exe) that DLL-sideloads a malicious AsTaskSched.dll — the TELESHIM first-stage backdoor.
TELESHIM is a 32-bit C++ DLL compiled in July 2026 that installs a 7-byte inline hook at offset 0x1394 in the host process (using VirtualProtect to alter memory permissions) to redirect execution to its payload. It checks a mutex named '\----WebKitFormBoundary7MA4YWxkTrZu0g' to prevent re-infection, and applies two string-encryption schemes: per-string XOR keys wrapped in control-flow-flattened decryption routines, and Base64-then-rolling-XOR (44-byte key) for network-related strings. Before beaconing, TELESHIM performs three anti-analysis checks: an I/O stress test (~1GB written/read across 1,000 iterations to %TEMP%\CVR9EEA.tmp to stall emulated sandboxes), a CPUID (EAX=1) hypervisor check (terminates if ECX bit 31 is set), and a WMI RAM-speed query (`wmic memorychip get speed`) that terminates execution if the value is zero/undefined. Persistence is established by copying the legitimate binary and malicious DLL into C:\programdata\shimgen_Data\ and registering a scheduled task named 'shimgen' that re-executes every 6 minutes.
C2 is conducted entirely over the Telegram Bot API (api.telegram.org), polling `/bot<TOKEN>/getUpdates?offset=<N>` with a spoofed macOS Safari User-Agent. The malware retrieves the victim's MAC address via GetAdaptersInfo for identification; the control message '13' triggers MAC registration with the operator, while other inbound messages are validated against the registered MAC and executed as shell commands via cmd.exe /C, or trigger file retrieval via `/bot<TOKEN>/getFile?file_id=<FILE_ID>` followed by rolling-XOR decryption and execution.
During the observed intrusion window, the operator ran standard reconnaissance (net user, tasklist, hostname, ipconfig /all, ipconfig /displaydns, netstat -ano, directory listings of C:\Users and staging paths under C:\ProgramData), then deployed a second persistence mechanism — a scheduled task named 'Feedback' every 10 minutes launching C:\ProgramData\Intel\winProAlertService.exe — and staged the MIXEDKEY second-stage loader by sideloading a malicious pthreadVC2.dll next to a legitimate GoPro binary (GoProAlertService.exe) alongside genuine MSVCP120.dll/MSVCR120.dll.
MIXEDKEY is a 64-bit reflective DLL loader that reconstructs its internal strings using ~1,000 mixed-boolean-arithmetic instructions per byte, assembled out of order. It implements environmental keying so the final BINDCLOAK payload only decrypts on the intended victim: it retrieves the machine's volume serial number via GetVolumeInformationA, derives a 20-byte rolling XOR key by repeating that serial 5 times, reads the encrypted payload from C:\ProgramData\Crypto\DSS\C99F29AC08454855B3D538960BB2F34F.PCPKEY (a filename that spoofs the Microsoft Platform Crypto Provider), decrypts a first layer using the file's own leading 311 bytes as a rolling XOR key, decrypts a second layer with the volume-serial-derived key, strips the MZ signature/size-prefix header, and reflectively loads the resulting PE — the BINDCLOAK C2 implant, which communicates with cert.hypersnet[.]com. Operators also pinged ssl.blsouqs[.]com and contacts.ftabnews[.]com from compromised hosts, suggesting additional or fallback infrastructure. ThreatLabz has not attributed the activity to a known APT group and has reserved a deep-dive on BINDCLOAK's C2 protocol for a follow-up (Part 2) report not yet published at time of writing.
MITRE ATT&CK techniques used in TL-2026-1582
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1497 Virtualization/Sandbox Evasion
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Persistence
Privilege Escalation
Initial Access
T1133 External Remote Services; T1566 Phishing
stealth
Affected products and versions in TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses
- Microsoft — Windows (unspecified versions)
Vulnerable versions: all supported Windows versions targeted by social-engineering ISO delivery
Remediation for TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses
Immediate actions
- Block network communication to cert.hypersnet[.]com, ssl.blsouqs[.]com, and contacts.ftabnews[.]com
- Hunt for scheduled tasks named 'shimgen' (6-minute interval) and 'Feedback' (10-minute interval) executing from C:\programdata\shimgen_Data\ or C:\ProgramData\Intel\
- Hunt for files C:\ProgramData\Crypto\DSS\C99F29AC08454855B3D538960BB2F34F.PCPKEY and sibling GoProAlertService.exe/pthreadVC2.dll/MSVCP120.dll/MSVCR120.dll outside legitimate GoPro install paths
- Alert on outbound HTTPS traffic to api.telegram.org from endpoints with no legitimate Telegram business use, especially repeated GET polling to /bot<token>/getUpdates
- Isolate and forensically image any host that mounted ISO/IMG attachments themed as diplomatic 'cooperation protocol' or 'border agreement' documents
Workarounds
- Block or restrict access to api.telegram.org at the network egress layer for endpoints that have no business justification for Telegram usage
Longer-term hardening
- Deploy application allowlisting / code-signing enforcement to detect renamed or relocated signed binaries (RegSchdTask.exe, GoProAlertService.exe) used for DLL sideloading
- Restrict mounting of ISO/IMG email attachments at the mail gateway for government users
- Implement EDR behavioral detection for inline API hooking (7-byte hook patterns via VirtualProtect) and reflective PE loading
- Deploy network-layer detection/blocking of Telegram Bot API traffic as an approved C2 channel for high-sensitivity environments
- Baseline and alert on anomalous scheduled task creation intervals (sub-15-minute recurring tasks) on government endpoints
Weaknesses (CWE) in TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses
Timeline of TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses
- Two earlier TELESHIM (AsTaskSched.dll / dlpprem64.dll) instances compiled in 2025, indicating the malware family and DLL-sideloading tradecraft predate the July 2026 operation by roughly a year.
- Newest TELESHIM (AsTaskSched.dll) sample compiled in July 2026, indicating active campaign preparation just prior to observed operations.
- Threat actor post-compromise activity begins against Middle East government targets; command execution restricted to a 04:00-12:00 UTC daily window across the campaign.
- Operator conducts system/network reconnaissance (net user, tasklist, ipconfig, netstat) and stages MIXEDKEY loader via GoProAlertService.exe/pthreadVC2.dll sideloading; 'Feedback' scheduled task registered for 10-minute persistence.
- Observed threat actor operational activity window concludes; across July 7-9, activity was heavily concentrated in the 07:00-11:00 UTC sub-window each day.
- Zscaler ThreatLabz publishes Part 1 technical analysis ('Targeted Attack on Government Entities in the Middle East') disclosing TELESHIM, MIXEDKEY, and the campaign's attack chain, IOCs, and infrastructure.
- ThreatLabz reserves detailed technical analysis of the BINDCLOAK C2 implant's protocol for a forthcoming Part 2 report, not yet published at time of writing.
- GBHackers coverage of the campaign ingested into the Threadlinqs hunt pipeline as TL-2026-1582.
- GBHackers and CyberPress publish news coverage summarizing the ThreatLabz findings and DLL sideloading tradecraft; Security Boulevard mirrors the ThreatLabz Part 1 writeup.
Sources cited for TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses
- Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments
- Targeted Attack on Government Entities in the Middle East | Part 1
- Targeted Attack on Government Entities in the Middle East | Part 1 (mirror)
- DLL Sideloading Technique Used by China-Aligned APT to Strike Government and Media Sectors
- Zscaler ThreatLabz research index
Detection coverage for TL-2026-1582
As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1582 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.