# TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses Telegram Bot API for C2 Against Middle East Governments

> A suspected East Asia-linked threat actor targeted Middle East government entities in a multi-stage intrusion (July 7-9, 2026) delivering the TELESHIM backdoor, MIXEDKEY reflective loader, and BINDCLOAK C2 implant. TELESHIM abuses the Telegram Bot API for encrypted HTTPS polling C2, validates commands against a victim's MAC address, and uses hypervisor/CPUID, WMI RAM, and I/O-stress anti-sandbox checks alongside control-flow-flattened and mixed-boolean-arithmetic obfuscation.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1582
- **ID:** TL-2026-1582
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Zscaler ThreatLabz identified a previously undocumented, multi-stage malware campaign targeting Middle East government entities, assessed with moderate-to-high confidence as operated out of East Asia based on attacker IP geolocation, Windows locale configuration, and an operational window tightly bounded to 04:00-12:00 UTC (peak 07:00-11:00 UTC) during July 7-9, 2026.

Initial access is via a weaponized ISO disguised as diplomatic documents (e.g. 'Cooperation protocol for the exploration of petroleum and gas (English)' and 'Agreement on Common Border Offices (English)'), which contains a legitimate ASUSTek-signed executable (RegSchdTask.exe, renamed shimgen.exe) that DLL-sideloads a malicious AsTaskSched.dll — the TELESHIM first-stage backdoor.

TELESHIM is a 32-bit C++ DLL compiled in July 2026 that installs a 7-byte inline hook at offset 0x1394 in the host process (using VirtualProtect to alter memory permissions) to redirect execution to its payload. It checks a mutex named '\----WebKitFormBoundary7MA4YWxkTrZu0g' to prevent re-infection, and applies two string-encryption schemes: per-string XOR keys wrapped in control-flow-flattened decryption routines, and Base64-then-rolling-XOR (44-byte key) for network-related strings. Before beaconing, TELESHIM performs three anti-analysis checks: an I/O stress test (~1GB written/read across 1,000 iterations to %TEMP%\CVR9EEA.tmp to stall emulated sandboxes), a CPUID (EAX=1) hypervisor check (terminates if ECX bit 31 is set), and a WMI RAM-speed query (`wmic memorychip get speed`) that terminates execution if the value is zero/undefined. Persistence is established by copying the legitimate binary and malicious DLL into C:\programdata\shimgen_Data\ and registering a scheduled task named 'shimgen' that re-executes every 6 minutes.

C2 is conducted entirely over the Telegram Bot API (api.telegram.org), polling `/bot<TOKEN>/getUpdates?offset=<N>` with a spoofed macOS Safari User-Agent. The malware retrieves the victim's MAC address via GetAdaptersInfo for identification; the control message '13' triggers MAC registration with the operator, while other inbound messages are validated against the registered MAC and executed as shell commands via cmd.exe /C, or trigger file retrieval via `/bot<TOKEN>/getFile?file_id=<FILE_ID>` followed by rolling-XOR decryption and execution.

During the observed intrusion window, the operator ran standard reconnaissance (net user, tasklist, hostname, ipconfig /all, ipconfig /displaydns, netstat -ano, directory listings of C:\Users and staging paths under C:\ProgramData), then deployed a second persistence mechanism — a scheduled task named 'Feedback' every 10 minutes launching C:\ProgramData\Intel\winProAlertService.exe — and staged the MIXEDKEY second-stage loader by sideloading a malicious pthreadVC2.dll next to a legitimate GoPro binary (GoProAlertService.exe) alongside genuine MSVCP120.dll/MSVCR120.dll.

MIXEDKEY is a 64-bit reflective DLL loader that reconstructs its internal strings using ~1,000 mixed-boolean-arithmetic instructions per byte, assembled out of order. It implements environmental keying so the final BINDCLOAK payload only decrypts on the intended victim: it retrieves the machine's volume serial number via GetVolumeInformationA, derives a 20-byte rolling XOR key by repeating that serial 5 times, reads the encrypted payload from C:\ProgramData\Crypto\DSS\C99F29AC08454855B3D538960BB2F34F.PCPKEY (a filename that spoofs the Microsoft Platform Crypto Provider), decrypts a first layer using the file's own leading 311 bytes as a rolling XOR key, decrypts a second layer with the volume-serial-derived key, strips the MZ signature/size-prefix header, and reflectively loads the resulting PE — the BINDCLOAK C2 implant, which communicates with cert.hypersnet[.]com. Operators also pinged ssl.blsouqs[.]com and contacts.ftabnews[.]com from compromised hosts, suggesting additional or fallback infrastructure. ThreatLabz has not attributed the activity to a known APT group and has reserved a deep-dive on BINDCLOAK's C2 protocol for a follow-up (Part 2) report not yet published at time of writing.

## MITRE ATT&CK

- T1566 Phishing
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1106 Native API
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1218 System Binary Proxy Execution
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1049 System Network Connections Discovery
- T1497 Virtualization/Sandbox Evasion
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1001 Data Obfuscation
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1008 Fallback Channels

## Sources

- [Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments](https://gbhackers.com/hackers-hide-c2-traffic-inside-telegram/)
- [Targeted Attack on Government Entities in the Middle East | Part 1](https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1)
- [Targeted Attack on Government Entities in the Middle East | Part 1 (mirror)](https://securityboulevard.com/2026/07/targeted-attack-on-government-entities-in-the-middle-east-part-1/)
- [DLL Sideloading Technique Used by China-Aligned APT to Strike Government and Media Sectors](https://cyberpress.org/dll-sideloading-attack/)
- [Zscaler ThreatLabz research index](https://threatlabz.zscaler.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1582