Threat reportMalwareTL-2026-1844
BINDCLOAK Backdoor Campaign Targeting Middle East Government Entities
BINDCLOAK Backdoor Campaign Targeting Middle East Government (TL-2026-1844), also tracked as TELESHIM Campaign, is a high-severity malware campaign, first published 2026-08-03. It has no confirmed attribution, affects Microsoft Windows, maps to 19 MITRE ATT&CK techniques (T1027, T1033, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1844
- Threat ID
- TL-2026-1844
- Also known as
- TELESHIM Campaign, Middle East Government Espionage Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- HIGH
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, health, research, logistics, police - law enforcement
- Target regions
- Middle East, 143 - Central Asia
- Detection rules
- 9
- Indicators of compromise
- 20
How BINDCLOAK Backdoor Campaign Targeting Middle East Government works
An East Asia-linked threat actor deployed a multi-stage attack chain using three previously undocumented malware families—TELESHIM (Telegram API C2), MIXEDKEY (reflective loader), and BINDCLOAK (64-bit modular C2 implant)—against government entities in the Middle East energy sector. BINDCLOAK shares code and infrastructure overlaps with the OctLurk backdoor family previously observed targeting Central Asia, marking a geographic expansion of operations.
In July 2026, Zscaler ThreatLabz observed a sophisticated multi-stage cyber espionage campaign targeting government entities in the Middle East, with a particular focus on the energy sector. The campaign employs three previously undocumented malware families in a staged attack chain: TELESHIM, a 32-bit C++ DLL backdoor that abuses the Telegram API for C2 communication to blend with legitimate traffic; MIXEDKEY, a heavily obfuscated 64-bit reflective PE loader; and BINDCLOAK, a 64-bit modular C2 implant written in C++ that serves as the final payload.
Initial access is achieved via an ISO file delivered within a ZIP archive, themed as either a petroleum/gas cooperation protocol or a border agreement. The ISO contains a legitimate ASUSTek binary (RegSchdTask.exe) that DLL-sideloads the malicious AsTaskSched.dll (TELESHIM). Upon execution, TELESHIM installs a 7-byte hook at a hardcoded offset in the host EXE to redirect execution into the implant's main payload. It establishes persistence via a scheduled task (shimgen) running every 6 minutes, and communicates through api.telegram.org using a hardcoded bot token and chat ID, with MAC address-based victim identification.
TELESHIM deploys MIXEDKEY as a stage-2 loader, delivered as a malicious pthreadVC2.dll sideloaded by a renamed legitimate GoProAlertService.exe. MIXEDKEY employs heavy Mixed Boolean Arithmetic (MBA) obfuscation, generating opaque predicates and junk instructions. It reads an encrypted payload file stored as C99F29AC08454855B3D538960BB2F34F.PCPKEY in C:\ProgramData\Crypto\DSS\—a filename designed to impersonate Microsoft Platform Crypto Provider files. Decryption uses two XOR layers: first, a 311-byte rolling key from the file header; second, a 20-byte key derived from the victim's volume serial number (environmental keying), ensuring the payload only decrypts on the intended target. The resulting PE, with its MZ signature stripped and 4-byte size prefix, is reflectively loaded and its export invoked.
BINDCLOAK is a 64-bit modular C2 implant supporting 11 commands organized into three categories: token operations (collect user tokens via LogonUserW, start modules with collected or process tokens via DuplicateTokenEx), module lifecycle management (start, stop, remove modules by ID), and plugin module loading (reflectively load plugin DLLs from C2 into RWX-allocated memory). EDR evasion is a core design focus: reflective DLL loading avoids standard LoadLibrary calls from unbacked executable memory, and import resolution is performed via RtlQueueWorkItem—queuing LoadLibraryW as a work item rather than calling it directly, bypassing EDR heuristics that flag unbacked memory regions calling LoadLibraryW.
C2 communication uses TLS over TCP with a custom binary protocol. Beacon messages (1568 bytes) contain OS version info, computer name, username, hostname, local IP, platform flag, and local timestamp. Message encryption is a three-stage process shared with OctLurk: zlib compression, first XOR pass with a hardcoded 105-byte key, and a second XOR pass with an 83-byte per-message random key sent in cleartext to the server. Random padding (14-41 bytes) is appended to each transmission.
Post-compromise activity observed July 7-9, 2026 included system reconnaissance (net user, tasklist, hostname), network reconnaissance (ipconfig, netstat -ano), file system enumeration, creation of a secondary Feedback scheduled task running every 10 minutes, and network connectivity verification via pings to attacker-controlled domains. Operator activity was concentrated between 4 AM and 12 PM UTC (heavily 7-11 AM UTC), consistent with East Asian time zones.
BINDCLOAK shares substantial code and infrastructure overlaps with the OctLurk backdoor family (previously documented by Kaspersky targeting Central Asian governments since early 2025). Shared code includes identical beacon message structure, the same C2 message encryption algorithm (zlib + two-pass XOR with similar key structures), and plugin export naming (oct_lk_col). Infrastructure overlaps include a shared SSL certificate (serial 59fe1ef7707fe497d89f34505222862f) between cert.hypersnet[.]com (BINDCLOAK) and about.blsouqs[.]com (OctLurk), the same SSL Common Name (107.175.172.40), consistent use of Tucows for domain registration, Njalla name servers, ASN 14956 (RouterHosting LLC / Cloudzy) hosting, and post-compromise ping activity targeting both BINDCLOAK and OctLurk domains from compromised machines. An additional domain, contacts.ftabnews[.]com, is assessed as part of the same infrastructure based on registration patterns and observed ping activity. This campaign represents an expansion of the actor's victimology from Central Asia to the Middle East, marking a significant geographic escalation in targeting.
MITRE ATT&CK techniques used in TL-2026-1844
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter
Command and Control
T1095 Non-Application Layer Protocol; T1132 Data Encoding; T1573 Encrypted Channel
Privilege Escalation
T1134 Access Token Manipulation
Credential Access
stealth
Affected products and versions in BINDCLOAK Backdoor Campaign Targeting Middle East Government
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2019; Server 2022 - ASUSTek — RegSchdTask.exe
Vulnerable versions: All versions (abused as legitimate LOLBIN) - GoPro — GoProAlertService.exe
Vulnerable versions: All versions (abused as legitimate LOLBIN)
Remediation for BINDCLOAK Backdoor Campaign Targeting Middle East Government
Immediate actions
- Block C2 domains (cert.hypersnet.com, ssl.blsouqs.com, about.blsouqs.com, contacts.ftabnews.com) at perimeter DNS/proxy
- Block IP 107.175.172.40 and 144.172.116.111 at firewall
- Search for TELESHIM indicators: AsTaskSched.dll in C:\ProgramData\shimgen_Data\
- Search for MIXEDKEY indicators: pthreadVC2.dll associated with GoProAlertService.exe
- Search for BINDCLOAK indicators: PCPKEY files in C:\ProgramData\Crypto\DSS\
- Audit scheduled tasks for shimgen (6-min) and Feedback (10-min) tasks
Workarounds
- Restrict DLL sideloading opportunities for ASUSTek RegSchdTask.exe via Software Restriction Policies / AppLocker
- Disable autorun for ISO files to prevent drive-letter-based infection vectors
- Restrict execution of unsigned binaries in C:\ProgramData\ subdirectories via Windows Defender Attack Surface Reduction
Longer-term hardening
- Deploy EDR with behavioral detection for reflective DLL loading from unbacked memory
- Implement detection for RtlQueueWorkItem + LoadLibraryW sequences from non-standard memory regions
- Monitor Telegram API traffic from non-browser processes for anomalous bot communication
- Deploy network detection for custom binary protocol over TLS with structured beacon sizes (1568 bytes)
- Hunt for environmental keying patterns: processes reading volume serial numbers and performing multi-stage decryption
Timeline of BINDCLOAK Backdoor Campaign Targeting Middle East Government
- OctLurk and SilkLurk backdoors first observed targeting government organizations in Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, Syria) by Chinese-speaking threat actor
- Kaspersky Securelist publishes detailed analysis of OctLurk/SilkLurk backdoors, documenting custom C2 protocols, environmental keying, and plugin architecture
- C2 domain cert.hypersnet.com registered via Njalla privacy registrar, hosted on ASN 14956 (RouterHosting LLC / Cloudzy)
- Operator creates secondary scheduled task 'Feedback' running every 10 minutes; BINDCLOAK beaconing to cert.hypersnet.com observed
- Threat actor conducts system reconnaissance (net user, tasklist, hostname), network reconnaissance (ipconfig /all, netstat -ano), and file system enumeration on compromised hosts
- First signs of BINDCLOAK campaign detected; TELESHIM backdoor observed communicating via Telegram API from compromised Middle East government networks
- Threat actor pings multiple C2 domains from compromised hosts: cert.hypersnet.com, ssl.blsouqs.com, and contacts.ftabnews.com to verify network connectivity
- Last observed operator activity in the compromised environment; activity concentrated between 7-11 AM UTC (East Asian business hours)
- Analysts confirm SSL certificate reuse (serial 59fe1ef7707fe497d89f34505222862f) linking cert.hypersnet.com with OctLurk domain about.blsouqs.com; both share CN 107.175.172.40
- Zscaler ThreatLabz publishes Part 2 with deep technical analysis of BINDCLOAK: 11 C2 commands, 3-stage message encryption, reflective plugin loading via RtlQueueWorkItem, and evidence of geographic expansion from Central Asia to Middle East
- Zscaler ThreatLabz publishes Part 1 of analysis detailing TELESHIM Telegram C2 backdoor, MIXEDKEY reflective loader, and initial BINDCLOAK discovery
Sources cited for BINDCLOAK Backdoor Campaign Targeting Middle East Government
- Targeted Attack on Government Entities in the Middle East (Part 1)
- Targeted Attack on Government Entities in the Middle East (Part 2)
- OctLurk and SilkLurk: New Backdoors in Central Asia
- BINDCLOAK - Threat Wiki
- TELESHIM Campaign - Threat Wiki
- TELESHIM/MIXEDKEY/BINDCLOAK Targeted Middle East Government Attack - OTX Pulse Analysis
- ASN 14956 RouterHosting LLC - ThreatFox
- DNS Lookup: cert.hypersnet.com - WhoisFreaks
Detection coverage for TL-2026-1844
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1844 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.