New Telegram Malware Campaign Targets Middle East Governments, Researchers Say

Cybersecurity experts have discovered a new hacking operation aimed at government institutions across the Middle East. The attackers managed to find a creative way to compromise the devices and use the popular Telegram instant messaging software to communicate with them.

This hacking campaign makes use of three novel malware families: TELEDHIM, MIXEDKEY, and BINDCLOAK. The identity of the attacker is believed to be someone originating from East Asia and is said to have engaged in this criminal activity, notes Zscaler ThreatLabz.

How the Attack Begins

The attack process begins with an innocent user opening an ISO file. This ISO file has both legitimate “RegSchdTask.exe” and malicious “AsTaskSched.dll” files belonging to computer manufacturer ASUSTek.

In the next stage, the malware DLL file runs through the legitimate executable program. This is the start of the attack that experts refer to as DLL side-loading.

The first-stage malware in this attack is TELESHIM, a 32-bit backdoor malware coded in C++. Its goal is to give attackers an entry point into victims’ networks. It achieves this by creating a scheduled task named “shimgen,” which runs the malware every six minutes.

Abusing Telegram for Command and Control

TELESHIM’s most unique feature is how it communicates with its operators. Instead of connecting with suspicious servers, the malware uses the Telegram Bot API. Telegram is a very popular messaging application with a wide range of users throughout the world.

Security systems often regard Telegram traffic as authentic, and malware exploits this fact by presenting the conductive commands of the malware as normal Telegram messages.

The exploitation of Telegram’s infrastructure is a recurring theme. Not long ago, a massive Telegram data breach claim emerged online, highlighting the platform’s security challenges.

By sending an HTTP request to api.telegram.org, the malware is able to fetch commands from a target chat. It often pretends to be a web browser using a User-Agent header that has been hardcoded, making its traffic appear innocent.

The TELESHIM backdoor supports two main types of messages. The first is a control message. This allows the malware to register the compromised machine by sending its MAC address to the attacker.

Also, it can run commands coming from the attackers and send back the output in encrypted chunks if the result is large. The malware can also transfer a message to download the required malware programs.

The Malware Uses Advanced Tactics to Avoid Detection 

The criminals are working hard in their attempts to avoid teleprompting detection. Malicious software depends on aggressive techniques of code obfuscation. That’s what makes it very difficult for experts to make sense of the software’s functionality.

TELESHIM, by design, avoids running in virtualized environments that researchers use to study malware. It has several anti-analysis features, including using the CPUID instruction to check for a hypervisor.

A hypervisor is software that creates virtual machines, and malware often stops running if it detects one to avoid analysis. It also uses Windows Management Instrumentation (WMI) to perform a RAM speed check. Virtual machines often report slower or incorrect RAM speeds, and the malware will terminate if it detects this.

The Final Payload is Locked to Its Target

After establishing a foothold, the attackers deliver the next-stage malware. They use another DLL side-loading chain with a legitimate file named “GoProAlertService.exe” and a malicious DLL named “pthreadVC2.dll”. This DLL is a reflective loader with the name MIXEDKEY. It decrypts and loads the final payload.

What’s notable about this final payload, BINDCLOAK, is its use of a technique called environmental keying. The final payload is locked with two layers of encryption. The second layer uses a decryption key derived from the volume serial number of the infected machine.

This is a form of environmental keying, a very targeted approach. It implies that the malicious software will decrypt and execute only on the computer(s) for which it has been programmed. If scientists or other organizations attempt to run it on their computer, decryption will fail, making the analysis impossible.

The BINDCLOAK is a 64-bit implant written in C++. It connects to an external command and control server at ‘cert.hypersnet[.]com’. After the initial infection, researchers observed the operators conducting post-compromise activity.

They caught the attackers conducting reconnaissance commands on the system, user, and network to get additional information regarding the environment of the target. Most of the activity happened between July 7 and July 9, 2026.

In addition, a time analysis showed that the attackers issued the C2 commands within the period from 4 a.m. to 12 p.m. UTC. The highest activity occurred between 7 a.m. and 11 a.m. UTC.

Using the public IP address of the threat actor, system locale, geolocation, and hours active, Zscaler concludes with medium to high confidence that the actors originate from East Asia.