Researchers at Zscaler ThreatLabz have uncovered a fresh cyber-espionage campaign against government bodies in the Middle East, run by a still-unnamed group they assess with moderate to high confidence is operating out of East Asia. The standout trick: the attackers hide their remote-control traffic inside Telegram, so the malware's check-ins look like ordinary chat-app activity rather than a beacon to a hacker's server.
The intrusions, spotted in July 2026, leaned on three previously undocumented custom tools that Zscaler named TELESHIM, MIXEDKEY, and BINDCLOAK. The findings, published by ThreatLabz researcher Sudeep Singh, echo a wider pattern of state-aligned crews abusing trusted online services to blend in. IntelFusions has tracked the same playbook against the region before, from MuddyWater's Telegram-bot backdoors across MENA to OilRig's email-based espionage against Middle Eastern telecoms.
What's affected
The targets are government entities in the Middle East. Victims were lured with diplomatic-themed decoy documents, including files posing as a "Cooperation protocol for the exploration of petroleum and gas" and an "Agreement on the Establishment of Common Border Offices," delivered as disk-image (ISO) files. Opening one triggers a multi-stage infection.
How the attack works
The ISO carries a legitimate, signed ASUS program (RegSchdTask.exe) that is tricked into loading a malicious library alongside it, a technique known as DLL sideloading that lets the malware run under the cover of trusted software. That library is TELESHIM, a stealthy backdoor that plants a scheduled task to relaunch itself every few minutes and packs a heavy set of anti-analysis checks: it stalls in sandboxes by generating roughly a gigabyte of junk disk activity, probes the CPU and system memory to spot virtual machines, and heavily obfuscates its own code to slow reverse engineers.
For command and control, TELESHIM talks to the operators over the Telegram bot API, polling for instructions and running any commands it receives through the Windows shell. When the operators want to go deeper, a second-stage loader called MIXEDKEY decrypts and launches the final implant, BINDCLOAK. Crucially, MIXEDKEY uses "environmental keying," deriving its decryption key from the specific infected machine's disk volume serial number so the payload only unpacks on the intended target and resists analysis by anyone else.
Once inside, the operators ran hands-on-keyboard reconnaissance between July 7 and 9, listing users, processes, network settings, and files before deploying follow-on payloads. Their command timing, concentrated between roughly 7 and 11 AM UTC, matched East Asian working hours and helped inform the assessment. ThreatLabz has not tied the activity to any named APT group yet.
What you should do
Defenders should hunt for suspicious scheduled tasks named "shimgen" or "Feedback" that relaunch a binary every few minutes, unexpected outbound requests to the Telegram bot API from servers that have no business using it, and connections to the C2 domain cert[.]hypersnet[.]com. Zscaler's report lists the full indicator set; salient markers include the TELESHIM loader (SHA-1 f46c01a5be2e08e36d4ec3302a8650a6ed25ec14) and the MIXEDKEY reflective loader (SHA-1 ee287d6a09295502ab2407aec336f9f0d8477d68). Read the original ThreatLabz report for the complete analysis and indicators.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.