Cybersecurity researchers have identified a new cyber espionage campaign targeting government entities in the Middle East. This operation involves the deployment of previously undocumented malware families named TELESHIM, MIXEDKEY, and BINDCLOAK.
The attack begins with an ISO file containing a legitimate executable, ‘RegSchdTask.exe,’ which is exploited to sideload a malicious DLL, ‘AsTaskSched.dll.’ This DLL acts as a 32-bit Windows backdoor, referred to as TELESHIM, that utilizes the Telegram API for command-and-control (C2) communications, effectively blending malicious traffic with legitimate network activity.
TELESHIM’s primary function is to retrieve and execute additional payloads. Among these are components that initiate a second DLL sideloading sequence involving ‘GoProAlertService.exe’ and ‘pthreadVC2.dll.’ The latter serves as a reflective loader, codenamed MIXEDKEY, which decrypts and executes further encrypted payloads.
Both TELESHIM and MIXEDKEY employ advanced code obfuscation techniques, including string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates, to complicate reverse engineering efforts. Additionally, TELESHIM incorporates methods to detect virtualized analysis environments, such as hypervisor detection via CPUID and RAM speed checks using Windows Management Instrumentation (WMI).
TELESHIM’s C2 communications are categorized into two types: control messages, which register the infected host and execute received commands, and download-and-execute messages, which fetch and run secondary payloads as scheduled tasks. Notably, the final payload is secured with dual-layer XOR encryption, with the second layer employing ‘environmental keying.’ This technique uses the infected machine’s volume serial number as a decryption key, ensuring the malware activates only on intended targets.
The attack sequence culminates with the deployment of BINDCLOAK, a 64-bit C2 implant written in C++ that communicates with an external server, ‘cert.hypersnet[.]com.’ Post-compromise activities observed include system, user, and network reconnaissance commands, as well as the delivery of additional payloads. These activities were primarily conducted between July 7 and July 9, 2026, with C2 commands executed between 4 a.m. and 12 p.m. UTC, peaking between 7 a.m. and 11 a.m. UTC.
Based on the threat actor’s public IP address, system locale settings, IP geolocation, and operational hours, researchers assess with moderate-to-high confidence that the campaign originates from East Asia. However, attribution to a specific threat actor or group remains unconfirmed.
This campaign underscores a growing trend among cyber adversaries to evade endpoint detection and response (EDR) systems by leveraging trusted platforms like Telegram for C2 communications. The use of sophisticated code obfuscation techniques further complicates detection and analysis, highlighting the need for robust cybersecurity measures and continuous monitoring to defend against such advanced threats.
