Do Son 
At a glance
| Threat actor | Unnamed group with links to East Asia (moderate-to-high confidence) |
| Activity type | Targeted intrusion and suspected espionage; DLL side-loading and Telegram C2 |
| Targets / victims | Government entities in the Middle East |
| Scale | Multiple infected hosts; heavy activity July 7–9, 2026 |
| Law-enforcement status | No public attribution to a known APT; no arrests or charges reported |
| Source | Zscaler ThreatLabz |
TL;DR
Zscaler ThreatLabz found new TELESHIM malware aimed at Middle East governments. The backdoor hides its command traffic inside normal Telegram API calls. Researchers link the operator to East Asia, yet they name no known group.
What happened
In July 2026, Zscaler ThreatLabz spotted a fresh intrusion against government networks. The attack starts with an ISO file. Inside sits a legitimate ASUSTek program that side-loads a malicious DLL. That DLL is the TELESHIM backdoor.
TELESHIM then hooks the host program and runs inside a trusted process. As a result, it slips past many endpoint tools. The malware also stalls sandboxes with heavy disk writes and hypervisor checks. According to the report, this trick is “likely to stall the execution in … analysis environments.”
The attackers used lure documents with diplomatic and energy themes. One posed as a petroleum cooperation protocol. Another mimicked a border-office agreement. Both hid the real payload from casual view.
For persistence, TELESHIM sets up a scheduled task named shimgen. That task runs every six minutes and relaunches the backdoor. So the malware survives reboots and keeps its foothold.
Heavy obfuscation slows analysts
Both TELESHIM and MIXEDKEY pile on code obfuscation. They use control flow flattening, opaque predicates, and mixed boolean arithmetic. In one case, MIXEDKEY runs about 1,000 instructions just to build a single string byte. These layers waste an analyst’s time and hide the true logic. Encrypted strings add one more barrier.
How the Telegram C2 works
TELESHIM abuses the Telegram API for command-and-control. In practice, it polls a Telegram bot for new instructions. Because that traffic looks routine, it blends into everyday web activity. The malware also checks a mutex, so only one copy runs at a time.
To register a new victim, the backdoor sends its MAC address to the bot. It also spoofs an old browser User-Agent on every request. That header helps the traffic pass as ordinary browsing.
Zscaler notes that the backdoor “only executes commands addressed to its MAC address.” Therefore, each victim gets tightly scoped orders. After gaining access, operators ran quiet recon commands. They ran net user, tasklist, and ipconfig to size up each host. Next, they dropped a second loader named MIXEDKEY.
The staged payloads
MIXEDKEY decrypts and loads the final implant, called BINDCLOAK. Notably, the actor tied that payload to each machine. It derived a key from the machine’s volume serial number. Therefore, the code runs only on the intended target. This detail also slows down outside analysts.
The operators disguised files with care. They named the final implant to look like a Microsoft crypto provider file. That choice helped it hide among normal system data. It maps every stage, from the ISO lure to the BINDCLOAK beacon.
Who is behind TELESHIM malware
Attribution stays careful for now. ThreatLabz assesses “with moderate-to-high confidence that the threat actor is operating out of East Asia.” That view rests on the operator’s IP location, system locale, and working hours. However, the team still names no known APT group. No arrests or charges have been reported, either.
Impact and scale
The campaign struck government entities, so the stakes run high. Most command activity fell between July 7 and July 9, 2026. The operators also kept a steady window, from 4 AM to 12 PM UTC. That rhythm points to a disciplined team on a fixed shift.
Government targets make this campaign an espionage concern. Stolen documents could expose talks, contracts, and internal plans. The energy-themed lures also hint at interest in the oil and gas sector.
What comes next
Zscaler plans a second post on the BINDCLOAK implant. Expect more detail on how BINDCLOAK talks to its server. Until then, defenders can act on the published indicators. Blocking the C2 domain cert.hypersnet[.]com is a smart first move.
How to stay protected
First, watch for odd DLL side-loading from signed programs. Second, flag Telegram API calls from servers that never use them. Third, alert on scheduled tasks that fire every few minutes from ProgramData. Regular threat-intel updates also help teams catch these tricks fast. Together, these small signals often expose TELESHIM malware early.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
