A hacking crew that spent the past year burrowing into Central Asian government networks has turned up in the Middle East, and researchers now have the code and the infrastructure to prove the two campaigns are one operation.
Zscaler's ThreatLabz team published the second half of its analysis on August 3, 2026, documenting BINDCLOAK, a previously undocumented backdoor recovered from Middle East government entities. Sudeep Singh and Roy Tay, who wrote the original report, assess with high confidence that BINDCLOAK is a variant of OctLurk, a backdoor previously used against Central Asia. ThreatLabz describes the operators as an East Asia-linked threat actor.
What ties the two campaigns together
The link rests on more than a family resemblance in the code. The command-and-control domain in the new campaign, cert.hypersnet[.]com, serves an SSL certificate with the serial number 59fe1ef7707fe497d89f34505222862f and a common name of 107[.]175[.]172[.]40. That is the same certificate used by about.blsouqs[.]com, an OctLurk C2 server. Once inside victim networks the operators also pinged both of those domains plus a third, contacts.ftabnews[.]com, which ThreatLabz assesses with high confidence is also theirs. The group consistently registers its domains through Tucows, points them at Njalla name servers, and hosts on ASN 14956.
The victimology has moved as well. Kaspersky has tracked this group against Central Asian targets since early 2025. ThreatLabz identified the Middle East campaign in July 2026 and says it carries a key focus on the energy vertical. IntelFusions covered the first stage of the Middle East campaign and the earlier Central Asian intrusions as separate stories. This is the report that joins them up.
How BINDCLOAK works
BINDCLOAK is a 64-bit modular Windows backdoor written in C++ and deployed only after the operators already hold a foothold. The MIXEDKEY loader documented in Part 1 decrypts it and reflectively loads it, meaning the backdoor is mapped straight into memory rather than run from a file on disk.
Once running, it fingerprints the host by adding up the character values of the computer name and adding that total to the serial number of the C: volume, producing a four-byte identifier that tags every message it sends home. Traffic leaves over TLS, zlib compressed and then XOR encrypted twice. One of the two keys is generated at random per message and sent in the clear so the server can unwrap it.
The backdoor carries two core modules and accepts eleven commands, several of which exist purely to collect and reuse Windows access tokens. One logs in with credentials the operator supplies and stores the resulting token; others start modules under that token, or under a token borrowed from a running process. That is how the operators raise their privileges without dropping new tools. Extra capability arrives as plugin DLLs the C2 server pushes on demand.
ThreatLabz also flags a deliberate piece of anti-detection engineering. When the plugin loader resolves its imports, it queues LoadLibraryW through RtlQueueWorkItem instead of calling it directly, because endpoint detection products treat library loads that originate from unbacked executable memory as highly suspicious. The effect is that a malicious load looks like it came from a normal thread.
Indicators
ThreatLabz published the following, defanged here:
- C2 domain: cert.hypersnet[.]com
- MD5: 7a14a99d70d42d3f7bf72f843185fc07
- SHA1: 577b1cc894636f4ac5ad670b0079b9b7ade137c3
- SHA256: 3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d
Government and energy organisations across the region should hunt for outbound TLS sessions to that domain and to the related infrastructure, ssl.blsouqs[.]com and contacts.ftabnews[.]com. Zscaler detects the samples as Win64.Backdoor.BINDCLOAK.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.