# East Asian Cyber Threat Targets Middle Eastern Governments Using Telegram for Command and Control

*Published July 29, 2026*
*Source: [https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html](https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html)*

## Executive Summary

A cyber attack campaign linked to East Asia has targeted Middle Eastern governments using new malware that exploits Telegram for command and control. The campaign highlights advanced evasion tactics and sophisticated obfuscation techniques, posing significant challenges to cybersecurity defenses.

## Article

Recent cybersecurity investigations have uncovered a sophisticated cyber attack campaign linked to a threat actor from East Asia, targeting government organizations in the Middle East. The research, conducted by Zscaler ThreatLabz, identified the deployment of three new malware families, namely TELESHIM, MIXEDKEY, and BINDCLOAK. This campaign was detected earlier this month and involves a multi-stage attack chain designed to establish and sustain unauthorized access to compromised systems. TELESHIM is particularly notable for exploiting the Telegram API for command-and-control communications, enabling the malware to blend seamlessly with legitimate internet traffic.

The attack begins with an ISO file that contains a legitimate executable used to sideload a malicious DLL, leading to the installation of the TELESHIM backdoor. TELESHIM then uses Telegram to retrieve additional malicious components. Two secondary payloads activate another DLL sideloading chain, involving a reflective loader called MIXEDKEY, which decrypts and executes further encrypted content. Both TELESHIM and MIXEDKEY utilize advanced code obfuscation techniques, such as string encryption and control flow flattening, to complicate reverse engineering efforts.

A distinctive characteristic of the final payload is its dual-layer XOR encryption, with the second layer employing environmental keying. This method ensures the malware activates only on specific target machines by using a decryption key derived from the system's volume serial number. The attack concludes with the deployment of BINDCLOAK, a 64-bit command-and-control implant that establishes communication with an external server.

ThreatLabz's analysis of post-compromise activities revealed reconnaissance commands and further payload deliveries, primarily occurring between July 7 and July 9, 2026. The command-and-control operations were typically executed between 4 a.m. and 12 p.m. UTC. The evidence, including IP address geolocation and system locale data, suggests that the threat actor likely originates from East Asia, although no specific group has been definitively identified. This campaign highlights trends such as evading endpoint detection and response systems, abusing trusted platforms like Telegram, and employing complex code obfuscation techniques to evade detection.