BINDCLOAK Backdoor Campaign Targeting Middle East Government Entities — Threadlinqs Intelligence
As of 2026-08-03, BINDCLOAK Backdoor Campaign Targeting Middle East Government Entities is a high-severity malware threat attributed to Unidentified East Asia-Linked Threat Actor (Unidentified (assessed East Asia)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1844 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unidentified East Asia-Linked Threat Actor · Unidentified (assessed East Asia) · ESPIONAGE
An East Asia-linked threat actor deployed a multi-stage attack chain using three previously undocumented malware families—TELESHIM (Telegram API C2), MIXEDKEY (reflective loader), and BINDCLOAK
In July 2026, Zscaler ThreatLabz observed a sophisticated multi-stage cyber espionage campaign targeting government entities in the Middle East, with a particular focus on the energy sector. The campaign employs three previously undocumented malware families in a staged attack chain: TELESHIM, a 32-bit C++ DLL backdoor that abuses the Telegram API for C2 communication to blend with legitimate traffic; MIXEDKEY, a heavily obfuscated 64-bit reflective PE loader; and BINDCLOAK, a 64-bit modular C2 implant written in C++ that serves as the final payload.
Initial access is achieved via an ISO file delivered within a ZIP archive, themed as either a petroleum/gas cooperation protocol or a border agreement. The ISO contains a legitimate ASUSTek binary (RegSchdTask.exe) that DLL-sideloads the malicious AsTaskSched.dll (TELESHIM). Upon execution, TELESHIM installs a 7-byte hook at a hardcoded offset in the host EXE to redirect execution into the implant's main payload. It establishes persistence via a scheduled task (shimgen) running every 6 minutes, and communicates through api.telegram.org using a hardcoded bot token and chat ID, with MAC address-based victim identification.
TELESHIM deploys MIXEDKEY as a stage-2 loader, delivered as a malicious pthreadVC2.dll sideloaded by a renamed legitimate GoProAlertService.exe. MIXEDKEY employs heavy Mixed Boolean Arithmetic (MBA) obfuscation, generating opaque predicates and junk instructions. It reads an encrypted payload file stored as C99F29AC08454855B3D538960BB2F34F.PCPKEY in C:\ProgramData\Crypto\DSS\—a filename designed to impersonate Microsoft Platform Crypto Provider files. Decryption uses two XOR layers: first, a 311-byte rolling key from the file header; second, a 20-byte key derived from the victim's volume serial number (environmental keying), ensuring the payload only decrypts on the intended target. The resulting PE, with its MZ signature stripped and 4-byte size prefix, is reflectively loaded and its export invoked.
BINDCLOAK is a 64-bit modular C2 implant supporting 11 commands organized into three categories: token operations (collect user tokens via LogonUserW, start modules with collected or process tokens via DuplicateTokenEx), module lifecycle management (start, stop, remove modules by ID), and plugin module loading (reflectively load plugin DLLs from C2 into RWX-allocated memory). EDR evasion is a core design focus: reflective DLL loading avoids standard LoadLibrary calls from unbacked executable memory, and import resolution is performed via RtlQueueWorkItem—queuing LoadLibraryW as a work item rather than calling it directly, bypassing EDR heuristics that flag unbacked memory regions calling LoadLibraryW.
C2 communication uses TLS over TCP with a custom binary protocol. Beacon messages (1568 bytes) contain OS version info, computer name, username, hostname, local IP, platform flag, and local timestamp. Message encryption is a three-stage process shared with OctLurk: zlib compression, first XOR pass with a hardcoded 105-byte key, and a second XOR pass with an 83-byte per-message random key sent in cleartext to the server. Random padding (14-41 bytes) is appended to each transmission.
Post-compromise activity observed July 7-9, 2026 included system reconnaissance (net user, tasklist, hostname), network reconnaissance (ipconfig, netstat -ano), file system enumeration, creation of a secondary Feedback scheduled task running every 10 minutes, and network connectivity verification via pings to attacker-controlled domains. Operator activity was concentrated between 4 AM and 12 PM UTC (heavily 7-11 AM UTC), consistent with East Asian time zones.
BINDCLOAK shares substantial code and infrastructure overlaps with the OctLurk backdoor family (previously documented by Kaspersky targeting Central Asian governments since early 2025). Shared code includes identical beacon message structure, the same C2 message encryption algorithm (zlib + two-pass XOR with similar key structures),
Target sectors: government administration, energy, health, research, logistics, police - law enforcement
Target regions: Middle East, 143 - Central Asia
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1053, T1059, T1574, T1134, T1620, T1027, T1497, T1055, T1036, T1552
