# BINDCLOAK: Previously Undocumented 64-bit Modular Windows Backdoor Stealing User/Process Tokens for Privilege Escalation

> BINDCLOAK is a previously undocumented 64-bit modular Windows backdoor (C++) that steals user and process tokens to escalate privileges via ImpersonateLoggedOnUser, DuplicateTokenEx, and LogonUserW. It is deployed as the stage-3 payload in an ISO-based multi-stage chain (TELESHIM > MIXEDKEY > BINDCLOAK) targeting Middle Eastern government entities with a focus on the energy sector. Zscaler ThreatLabz assesses with high confidence that BINDCLOAK is a variant of the OctLurk backdoor operated by an East Asia-linked espionage actor that previously targeted Central Asia.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1858
- **ID:** TL-2026-1858
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BINDCLOAK is a previously undocumented 64-bit modular Windows backdoor written in C++ that delivers privilege escalation through token theft rather than traditional exploit-based elevation. The malware is deployed as the final stage in a three-stage attack chain initiated through diplomatic-themed ISO file lures targeting Middle Eastern government entities, particularly in the energy sector.

The infection chain begins when a target opens an ISO file containing government-themed filenames such as 'Cooperation protocol for the exploration of petroleum and gas (English).img' or 'Agreement on the Establishment of Common Border Offices (English).img'. The ISO contains a legitimate ASUSTek RegSchdTask.exe binary alongside a malicious AsTaskSched.dll that is DLL side-loaded to execute TELESHIM, a 32-bit C++ backdoor that abuses the Telegram Bot API for command-and-control. TELESHIM performs extensive reconnaissance (net user, tasklist, ipconfig, netstat), uses heavy obfuscation (CFF/MBA/opaque predicates), and implements anti-analysis measures including CPUID-based hypervisor detection and a 1 GB I/O stress test designed to stall sandbox execution. It persists via a scheduled task named 'shimgen' running every 6 minutes.

Post-compromise, the threat actor deploys a legitimate GoPro binary alongside pthreadVC2.dll, which is actually MIXEDKEY — a 64-bit reflective loader. MIXEDKEY uses two-layer XOR decryption with environmental keying derived from the victim's C:\ volume serial number, ensuring the payload only decrypts on the intended target. MIXEDKEY reflectively loads the decrypted BINDCLOAK DLL into memory and invokes its curl_easy_escape export.

BINDCLOAK is a modular implant with two built-in modules (C2 module 0x1010 and Command module 0x1020) and a plugin architecture supporting reflective loading of additional DLLs delivered from the C2 server. Its core innovation is token-based privilege escalation: the Commands module (0x1020) implements COLLECT_USER_TOKEN (calls LogonUserW with supplied credentials to collect user token handles), GET_STATUS (enumerates processes via WTSEnumerateProcessesW with OpenProcessToken to inspect TOKEN_QUERY/TOKEN_DUPLICATE/TOKEN_ASSIGN_PRIMARY flags), START_MODULE_WITH_USER_TOKEN (calls DuplicateTokenEx with TOKEN_ASSIGN_PRIMARY to launch modules under a higher-privileged token), and START_MODULE_WITH_PROCESS_TOKEN (similar but using process tokens from running processes). This token abuse blends into normal Windows behavior, evading detection by appearing as legitimate impersonation.

BINDCLOAK communicates via TLS over TCP with a custom message-routing protocol. All messages use a 28-byte header followed by two variable-sized blob payloads. Beacon messages collect OS version (OSVERSIONINFOEX), computer name (GetComputerNameW), username (GetUserNameW), hostname (gethostname), local IP (GetAddrInfoW), and local time (GetLocalTime). Messages are triple-encrypted: zlib compression, followed by a 105-byte rolling XOR key constructed as a stack string, followed by an 83-byte random XOR key with random padding (14—41 bytes). The C2 infrastructure reuses an SSL certificate (serial 59fe1ef7707fe497d89f34505222862f, CN 107.175.172.40) across both BINDCLOAK (cert.hypersnet.com) and OctLurk (about.blsouqs.com) domains.

The plugin loader allocates RWX memory via VirtualAlloc, uses RtlQueueWorkItem to call LoadLibraryW for import resolution (evading EDR detection of LoadLibraryW calls from unbacked executable memory), and modifies PE headers to hinder static detection. Plugin module DLLs must export ins_ctl_db and oct_lk_col functions.

Zscaler ThreatLabz assesses with high confidence that BINDCLOAK is a variant of the OctLurk backdoor based on identical beacon message structures, the same encryption algorithm (zlib + double XOR), high XOR key similarity, shared infrastructure (SSL certificate reuse, Tucows registrar, Njalla name servers, ASN 14956), and operational overlaps (the actor pinged both BINDCLOAK and OctLurk C2 servers during post-compromise activity). Kaspersky GReAT separately documented OctLurk and a related backdoor (SilkLurk) targeting Central Asian governments and Syrian entities starting January 2025, attributed with medium confidence to a Chinese-speaking threat actor. The July 2026 campaign marks a notable geographic and sectoral expansion from Central Asian government targets to Middle Eastern energy sector entities.

## MITRE ATT&CK

- T1566 Phishing
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1119 Automated Collection
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1560 Archive Collected Data

## Sources

- [Zscaler ThreatLabz — Targeted Attack on Government Entities in the Middle East (Part 1)](https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1)
- [Zscaler ThreatLabz — Targeted Attack on Government Entities in the Middle East (Part 2)](https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-2)
- [BINDCLOAK Steals Windows Tokens — Cybersecurity News](https://cybersecuritynews.com/bindcloak-steals-windows-tokens/)
- [OctLurk and SilkLurk: New Backdoors in Central Asia — Kaspersky Securelist](https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/)
- [Zscaler ThreatLabz — Win64.Backdoor.BINDCLOAK](https://threatlibrary.zscaler.com/threats/)
- [Zscaler ThreatLabz — Win32.Backdoor.TELESHIM](https://threatlibrary.zscaler.com/threats/329bd2ab-0c8e-4368-9811-827e5ce02426)
- [Zscaler ThreatLabz — Win64.Loader.MIXEDKEY](https://threatlibrary.zscaler.com/threats/d047d77c-b9ed-459d-90e1-47e9b6f65dfb)
- [Kazakhstan STS — TrustFall/MystRodX Infrastructure Overlap](https://profitday.kz/pdf/security2025/15.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1858