# BINDCLOAK Backdoor Campaign Targeting Middle East Government Entities

> An East Asia-linked threat actor deployed a multi-stage attack chain using three previously undocumented malware families—TELESHIM (Telegram API C2), MIXEDKEY (reflective loader), and BINDCLOAK (64-bit modular C2 implant)—against government entities in the Middle East energy sector. BINDCLOAK shares code and infrastructure overlaps with the OctLurk backdoor family previously observed targeting Central Asia, marking a geographic expansion of operations.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1844
- **ID:** TL-2026-1844
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2026, Zscaler ThreatLabz observed a sophisticated multi-stage cyber espionage campaign targeting government entities in the Middle East, with a particular focus on the energy sector. The campaign employs three previously undocumented malware families in a staged attack chain: TELESHIM, a 32-bit C++ DLL backdoor that abuses the Telegram API for C2 communication to blend with legitimate traffic; MIXEDKEY, a heavily obfuscated 64-bit reflective PE loader; and BINDCLOAK, a 64-bit modular C2 implant written in C++ that serves as the final payload.

Initial access is achieved via an ISO file delivered within a ZIP archive, themed as either a petroleum/gas cooperation protocol or a border agreement. The ISO contains a legitimate ASUSTek binary (RegSchdTask.exe) that DLL-sideloads the malicious AsTaskSched.dll (TELESHIM). Upon execution, TELESHIM installs a 7-byte hook at a hardcoded offset in the host EXE to redirect execution into the implant's main payload. It establishes persistence via a scheduled task (shimgen) running every 6 minutes, and communicates through api.telegram.org using a hardcoded bot token and chat ID, with MAC address-based victim identification.

TELESHIM deploys MIXEDKEY as a stage-2 loader, delivered as a malicious pthreadVC2.dll sideloaded by a renamed legitimate GoProAlertService.exe. MIXEDKEY employs heavy Mixed Boolean Arithmetic (MBA) obfuscation, generating opaque predicates and junk instructions. It reads an encrypted payload file stored as C99F29AC08454855B3D538960BB2F34F.PCPKEY in C:\ProgramData\Crypto\DSS\—a filename designed to impersonate Microsoft Platform Crypto Provider files. Decryption uses two XOR layers: first, a 311-byte rolling key from the file header; second, a 20-byte key derived from the victim's volume serial number (environmental keying), ensuring the payload only decrypts on the intended target. The resulting PE, with its MZ signature stripped and 4-byte size prefix, is reflectively loaded and its export invoked.

BINDCLOAK is a 64-bit modular C2 implant supporting 11 commands organized into three categories: token operations (collect user tokens via LogonUserW, start modules with collected or process tokens via DuplicateTokenEx), module lifecycle management (start, stop, remove modules by ID), and plugin module loading (reflectively load plugin DLLs from C2 into RWX-allocated memory). EDR evasion is a core design focus: reflective DLL loading avoids standard LoadLibrary calls from unbacked executable memory, and import resolution is performed via RtlQueueWorkItem—queuing LoadLibraryW as a work item rather than calling it directly, bypassing EDR heuristics that flag unbacked memory regions calling LoadLibraryW.

C2 communication uses TLS over TCP with a custom binary protocol. Beacon messages (1568 bytes) contain OS version info, computer name, username, hostname, local IP, platform flag, and local timestamp. Message encryption is a three-stage process shared with OctLurk: zlib compression, first XOR pass with a hardcoded 105-byte key, and a second XOR pass with an 83-byte per-message random key sent in cleartext to the server. Random padding (14-41 bytes) is appended to each transmission.

Post-compromise activity observed July 7-9, 2026 included system reconnaissance (net user, tasklist, hostname), network reconnaissance (ipconfig, netstat -ano), file system enumeration, creation of a secondary Feedback scheduled task running every 10 minutes, and network connectivity verification via pings to attacker-controlled domains. Operator activity was concentrated between 4 AM and 12 PM UTC (heavily 7-11 AM UTC), consistent with East Asian time zones.

BINDCLOAK shares substantial code and infrastructure overlaps with the OctLurk backdoor family (previously documented by Kaspersky targeting Central Asian governments since early 2025). Shared code includes identical beacon message structure, the same C2 message encryption algorithm (zlib + two-pass XOR with similar key structures), and plugin export naming (oct_lk_col). Infrastructure overlaps include a shared SSL certificate (serial 59fe1ef7707fe497d89f34505222862f) between cert.hypersnet[.]com (BINDCLOAK) and about.blsouqs[.]com (OctLurk), the same SSL Common Name (107.175.172.40), consistent use of Tucows for domain registration, Njalla name servers, ASN 14956 (RouterHosting LLC / Cloudzy) hosting, and post-compromise ping activity targeting both BINDCLOAK and OctLurk domains from compromised machines. An additional domain, contacts.ftabnews[.]com, is assessed as part of the same infrastructure based on registration patterns and observed ping activity. This campaign represents an expansion of the actor's victimology from Central Asia to the Middle East, marking a significant geographic escalation in targeting.

## MITRE ATT&CK

- T1053 Scheduled Task/Job
- T1059 Command and Scripting Interpreter
- T1574 Hijack Execution Flow
- T1134 Access Token Manipulation
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1055 Process Injection
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1087 Account Discovery
- T1518 Software Discovery
- T1132 Data Encoding
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel

## Sources

- [Targeted Attack on Government Entities in the Middle East (Part 1)](https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1)
- [Targeted Attack on Government Entities in the Middle East (Part 2)](https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-2)
- [OctLurk and SilkLurk: New Backdoors in Central Asia](https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/)
- [BINDCLOAK - Threat Wiki](https://threat.wiki/tools/bindcloak/)
- [TELESHIM Campaign - Threat Wiki](https://threat.wiki/ops/teleshim-middle-east-government-espionage/)
- [TELESHIM/MIXEDKEY/BINDCLOAK Targeted Middle East Government Attack - OTX Pulse Analysis](https://securityarsenal.com/blog/teleshim-mixedkey-bindcloak-targeted-middle-east-government-attack-otx-pulse-analysis)
- [ASN 14956 RouterHosting LLC - ThreatFox](https://threatfox.abuse.ch/asn/14956/)
- [DNS Lookup: cert.hypersnet.com - WhoisFreaks](https://whoisfreaks.com/tools/dns/lookup/cert.hypersnet.com)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1844