BINDCLOAK: Previously Undocumented 64-bit Modular Windows Backdoor Stealing User/Process Tokens for Privilege Escalation — Threadlinqs Intelligence
As of 2026-08-04, BINDCLOAK: Previously Undocumented 64-bit Modular Windows Backdoor Stealing User/Process Tokens for Privilege Escalation is a high-severity malware threat attributed to Unidentified East Asia-linked Espionage Group (East Asia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1858 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unidentified East Asia-linked Espionage Group · East Asia · ESPIONAGE
BINDCLOAK is a previously undocumented 64-bit modular Windows backdoor (C++) that steals user and process tokens to escalate privileges via ImpersonateLoggedOnUser, DuplicateTokenEx, and LogonUserW.
BINDCLOAK is a previously undocumented 64-bit modular Windows backdoor written in C++ that delivers privilege escalation through token theft rather than traditional exploit-based elevation. The malware is deployed as the final stage in a three-stage attack chain initiated through diplomatic-themed ISO file lures targeting Middle Eastern government entities, particularly in the energy sector.
The infection chain begins when a target opens an ISO file containing government-themed filenames such as 'Cooperation protocol for the exploration of petroleum and gas (English).img' or 'Agreement on the Establishment of Common Border Offices (English).img'. The ISO contains a legitimate ASUSTek RegSchdTask.exe binary alongside a malicious AsTaskSched.dll that is DLL side-loaded to execute TELESHIM, a 32-bit C++ backdoor that abuses the Telegram Bot API for command-and-control. TELESHIM performs extensive reconnaissance (net user, tasklist, ipconfig, netstat), uses heavy obfuscation (CFF/MBA/opaque predicates), and implements anti-analysis measures including CPUID-based hypervisor detection and a 1 GB I/O stress test designed to stall sandbox execution. It persists via a scheduled task named 'shimgen' running every 6 minutes.
Post-compromise, the threat actor deploys a legitimate GoPro binary alongside pthreadVC2.dll, which is actually MIXEDKEY — a 64-bit reflective loader. MIXEDKEY uses two-layer XOR decryption with environmental keying derived from the victim's C:\ volume serial number, ensuring the payload only decrypts on the intended target. MIXEDKEY reflectively loads the decrypted BINDCLOAK DLL into memory and invokes its curl_easy_escape export.
BINDCLOAK is a modular implant with two built-in modules (C2 module 0x1010 and Command module 0x1020) and a plugin architecture supporting reflective loading of additional DLLs delivered from the C2 server. Its core innovation is token-based privilege escalation: the Commands module (0x1020) implements COLLECT_USER_TOKEN (calls LogonUserW with supplied credentials to collect user token handles), GET_STATUS (enumerates processes via WTSEnumerateProcessesW with OpenProcessToken to inspect TOKEN_QUERY/TOKEN_DUPLICATE/TOKEN_ASSIGN_PRIMARY flags), START_MODULE_WITH_USER_TOKEN (calls DuplicateTokenEx with TOKEN_ASSIGN_PRIMARY to launch modules under a higher-privileged token), and START_MODULE_WITH_PROCESS_TOKEN (similar but using process tokens from running processes). This token abuse blends into normal Windows behavior, evading detection by appearing as legitimate impersonation.
BINDCLOAK communicates via TLS over TCP with a custom message-routing protocol. All messages use a 28-byte header followed by two variable-sized blob payloads. Beacon messages collect OS version (OSVERSIONINFOEX), computer name (GetComputerNameW), username (GetUserNameW), hostname (gethostname), local IP (GetAddrInfoW), and local time (GetLocalTime). Messages are triple-encrypted: zlib compression, followed by a 105-byte rolling XOR key constructed as a stack string, followed by an 83-byte random XOR key with random padding (14—41 bytes). The C2 infrastructure reuses an SSL certificate (serial 59fe1ef7707fe497d89f34505222862f, CN 107.175.172.40) across both BINDCLOAK (cert.hypersnet.com) and OctLurk (about.blsouqs.com) domains.
The plugin loader allocates RWX memory via VirtualAlloc, uses RtlQueueWorkItem to call LoadLibraryW for import resolution (evading EDR detection of LoadLibraryW calls from unbacked executable memory), and modifies PE headers to hinder static detection. Plugin module DLLs must export ins_ctl_db and oct_lk_col functions.
Zscaler ThreatLabz assesses with high confidence that BINDCLOAK is a variant of the OctLurk backdoor based on identical beacon message structures, the same encryption algorithm (zlib + double XOR), high XOR key similarity, shared infrastructure (SSL certificate reuse, Tucows registrar, Njalla name servers, ASN 14956), and operational overlaps (the actor pinged both BINDCLOA
Target sectors: government administration, energy, health, education, police - law enforcement
Target regions: Middle East, 143 - Central Asia
Detections & IOCs
As of 2026-08-07, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1053, T1574, T1027, T1480, T1497, T1620, T1552, T1003, T1082
