Inside TELESHIM: How State-Sponsored Hackers Abuse Telegram to Target Middle East Governments

Reference image: Telegram C2 API abuse – Infographic courtesy of Zscaler ThreatLabz

Anatomy of a Sophisticated State-Sponsored Campaign

Multi-Stage Initial Access and DLL Side-Loading Mechanics

The digital threat landscape in the Middle East has long been a crucible for high-stakes, targeted cyber espionage. In July 2026, security researchers at Zscaler ThreatLabz uncovered a meticulously orchestrated campaign spearheaded by an adversary with suspected ties to East Asia. The primary targets of this campaign were high-profile government entities across the region. Rather than relying on traditional, easily flagged infrastructure or zero-day exploits for initial entry, the threat actors opted for a calculated, multi-stage infection chain designed to blend seamlessly into standard operational workflows.

The attack sequence begins with the delivery of an ISO container file. Inside this archive lies a legitimate, signed executable file named RegSchdTask.exe, which serves as the vehicle for a classic DLL side-loading maneuver. When the legitimate binary runs, it inadvertently loads a malicious dynamic-link library (.dll) titled AsTaskSched.dll. This rogue payload is actually a newly documented 32-bit Windows backdoor known as TELESHIM. By hitching its execution to a trusted system process, the threat actor evades basic host-based monitoring controls and sets the stage for persistence.

🔍 Persistence mechanism: Once executed, TELESHIM establishes a staging directory at C:\programdata\shimgen_Data\. Within this directory, the legitimate binary is copied as shimgen.exe alongside the malicious counterpart, ensuring structural continuity across reboots. The modular design of the attack does not stop there. The threat actors utilize subsequent DLL side-loading chains—incorporating binaries like GoProAlertService.exe and pthreadVC2.dll—to deploy advanced secondary components, reflecting an operational discipline focused on compartmentalization and stealth.

Profiling the Adversary and Operational Timelines

Attribution in modern cyber espionage requires triangulating a vast array of telemetry, ranging from code architecture to the human operational rhythms of the threat actors themselves. ThreatLabz telemetry captured post-compromise activity spanning a concentrated window between July 7 and July 9, 2026. A rigorous time-series analysis of the command-and-control (C2) issuance logs revealed a distinct behavioral fingerprint: commands were exclusively dispatched between 4 a.m. and 12 p.m. UTC, with a sharp concentration of activity occurring between 7 a.m. and 11 a.m. UTC.

This narrow operational window aligns cleanly with a specific geographic work day, mirroring standard business hours in East Asia. Combined with the public IP infrastructure, system locales configured on the operator's Windows servers, and network geolocation indicators, security analysts assess with moderate-to-high confidence that the campaign originates from an East Asian threat group. The targeting of Middle Eastern government infrastructure underscores a strategic intelligence-gathering mandate, aligning with broader geopolitical objectives in the region where diplomatic, energy, and defense sectors remain prime targets for foreign intelligence collection.

Dissecting the TELESHIM Backdoor and Telegram C2 Abuses

Evasion, Anti-Analysis, and Environment Stress Testing

Before executing its core malicious routines, TELESHIM subjects its host environment to rigorous scrutiny to ensure it is operating on a genuine victim machine rather than a security researcher's sandbox or an automated analysis environment. The backdoor begins by checking for an existing mutex named ----WebKitFormBoundary7MA4YWxkTrZu0g to guarantee that only a single instance of the malware executes at any given time.

⏳ Sandbox exhaustion: To confound automated detonation systems that rely on short timeout windows, TELESHIM initiates a resource-intensive I/O file stress test. It enters a loop of 1,000 iterations, repeatedly writing and reading approximately 1 MB of randomly generated data to %TEMP%\CVR9EEA.tmp, generating roughly 1 GB of total disk I/O per invocation. This deliberate dragging of system resources exhausts sandbox execution timers.

Furthermore, the malware employs aggressive hypervisor detection mechanisms via CPUID instructions and performs RAM speed checks through Windows Management Instrumentation (WMI) queries to spot virtualized environments. To protect its internal logic from static inspection, TELESHIM relies on heavy code obfuscation. Its codebase is fortified with Control Flow Flattening (CFF), complex Mixed Boolean Arithmetic (MBA) expressions, opaque predicates, and multi-layered string encryption, rendering traditional reverse engineering exceptionally tedious and resource-intensive.

Telegram API Integration and Polling Loop Execution

Perhaps the most notable architectural feature of TELESHIM is its abuse of the Telegram messaging platform's application programming interface (API) for command-and-control communications. By leveraging a legitimate, widely trusted cloud platform (api.telegram.org), the malware ensures its outbound C2 traffic blends invisibly into standard corporate network activity, confounding traditional perimeter firewalls and security information and event management (SIEM) heuristics that might otherwise flag anomalous foreign IP connections.

The hostname, Telegram bot token, and designated chat ID are heavily encrypted and embedded within the binary. TELESHIM enters a continuous polling loop, issuing HTTP GET requests to the Telegram endpoint via [https://api.telegram.org/bot](https://api.telegram.org/bot)[BOT_TOKEN]/getUpdates?offset=[N] to fetch pending instructions. The backdoor processes two primary categories of C2 messages:

• Control Messages: Upon receiving instructions, TELESHIM decrypts the message text. If the payload matches the string 13, the malware extracts, XOR-encrypts, and Base64-encodes the host machine's MAC address, transmitting it back to the bot to formally register the newly infected node. If the string differs, it is parsed as a shell command and executed silently via cmd.exe /C using CreateProcessA. Output exceeding 1,000 bytes is fragmented and exfiltrated in chunks.
• Download and Execute Messages: For secondary staging, the malware reads message captions containing targeted destination file paths and MAC address validations. If the host MAC matches, TELESHIM utilizes the Telegram file_id parameter to pull down secondary binaries via /bot[TOKEN]/getFile?file_id=[FILE_ID]. These payloads are decrypted using a 44-byte rolling XOR key and scheduled for execution via Windows scheduled tasks.

Secondary Tooling: MIXEDKEY and BINDCLOAK

Reflective Loading and Environmental Keying

While TELESHIM acts as the initial persistent foothold, the campaign's structural depth is exemplified by its secondary payloads, notably the reflective loader designated MIXEDKEY. Triggered via a secondary side-loading chain (GoProAlertService.exe and pthreadVC2.dll), MIXEDKEY operates directly in memory to decrypt and execute an encrypted payload file (C99F29AC08454855B3D538960BB2F34F.PCPKEY) without touching the disk, effectively minimizing forensic artifacts.

Reference image: Secondary payload encryption and environmental keying – Graphic courtesy of Zscaler ThreatLabz

🔐 Environmental keying in action: To ensure absolute operational security and prevent premature exposure on unintended machines, the threat actors implemented a strict environmental keying mechanism. The ultimate payload, BINDCLOAK, is locked behind two layers of XOR encryption. Crucially, the second encryption layer can only be unlocked using a dynamic decryption key derived mathematically from the specific target machine's volume serial number. If the malware is sandboxed or transferred to an analyst's workstation, the volume serial number will fail to match, rendering the payload entirely undecryptable and inert. This technique guarantees that the threat actor's advanced tooling detonates exclusively on pre-vetted, high-value victim infrastructure.

Post-Compromise Reconnaissance and Final Implant Deployment

The culmination of this multi-stage attack sequence is the deployment of BINDCLOAK, a robust 64-bit C2 implant written in C++. Unlike the Telegram-backed TELESHIM backdoor, BINDCLOAK establishes direct communication with an external dedicated infrastructure node (cert.hypersnet[.]com).

Once BINDCLOAK is active on the compromised network, the operators execute a flurry of post-compromise activities. Telemetry indicates the heavy execution of local system enumeration, user account discovery, and internal network reconnaissance commands. These actions are designed to map the terrain of the targeted Middle Eastern government agency, identify domain controllers or high-value workstations, and establish pathways for lateral movement before deeper data exfiltration commences.

Conclusion

The emergence of the TELESHIM campaign, alongside its companion payloads MIXEDKEY and BINDCLOAK, signals an evolutionary leap in how sophisticated state-sponsored threat actors weaponize trusted cloud services for espionage. By subverting the Telegram API for command-and-control operations, these operators effectively hide in plain sight, weaponizing the ubiquity of modern web traffic against traditional network defenses. Coupled with heavy code obfuscation, sandbox-defeating I/O stress tests, and rigid environmental keying tied to hardware serial numbers, the campaign exemplifies the growing barrier to entry in modern threat detection. Defending against such asymmetric threats requires shifting beyond basic signature-based detection toward deep behavioral analytics, memory forensics, and strict API-abuse monitoring across enterprise perimeters.

FAQs

1. What is TELESHIM and what is its primary function?

TELESHIM is a newly documented 32-bit Windows C++ DLL backdoor utilized in targeted cyber espionage campaigns. Its primary function is to establish an initial, persistent foothold on compromised systems and abuse the legitimate Telegram API for command-and-control (C2) communication.

2. Why do threat actors use Telegram for command-and-control (C2)?

Threat actors abuse platforms like Telegram because it is a globally trusted, legitimate messaging service with millions of active users. Routing malicious traffic through api.telegram.org allows malware communications to blend seamlessly with normal enterprise web traffic, making it difficult for standard perimeter firewalls to block without disrupting business operations.

3. What anti-analysis techniques does TELESHIM use to evade detection?

TELESHIM employs multiple evasion strategies, including hypervisor detection via CPUID, RAM speed checks using WMI, and a resource-intensive I/O file stress test that writes and reads roughly 1 GB of data to exhaust sandbox execution timers. It also uses heavy code obfuscation, such as Control Flow Flattening (CFF) and Mixed Boolean Arithmetic (MBA).

4. What is environmental keying and how was it used in this campaign?

Environmental keying is a defense-evasion technique where a payload is encrypted using data unique to the target system. In this campaign, the BINDCLOAK payload was encrypted using a key derived from the infected machine's volume serial number, ensuring the malware only decrypts and executes on the exact intended victim machine.

5. Which region and sector were primarily targeted by the TELESHIM campaign?

Discovered by Zscaler ThreatLabz in July 2026, the campaign specifically targeted high-ranking government entities located in the Middle East. Based on infrastructure telemetry and operational timelines, the attacks are attributed with moderate-to-high confidence to an East Asian threat actor.

All reference images used in this article are sourced from Zscaler ThreatLabz public threat intelligence. Content analysis based on Zscaler ThreatLabz July 2026 report.