TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
New malware families TELESHIM, MIXEDKEY, and BINDCLOAK used in attacks against Middle East governments.
A threat actor with ties to East Asia has been observed targeting government entities in the Middle East using previously unknown malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign leverages Telegram for command-and-control (C2) communication and employs sophisticated obfuscation techniques to evade detection and analysis.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Zscaler?
Get an email when a new story names Zscaler, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA suspected East Asian threat actor deployed novel malware families (TELESHIM, MIXEDKEY, BINDCLOAK) against Middle Eastern government entities, cleverly using Telegram's legitimate infrastructure as a command-and-control channel to blend malicious traffic with normal communications. This technique is particularly dangerous because blocking Telegram outright may be operationally disruptive, and standard perimeter defenses often fail to flag traffic to trusted messaging platforms. The use of sophisticated obfuscation techniques further delayed detection and analysis, extending the attacker's dwell time inside victim networks. This campaign highlights the growing trend of adversaries weaponizing trusted consumer platforms to evade detection, making behavioral and anomaly-based monitoring critical.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — cert.hypersnet[.]com
- malware — TELESHIM
- malware — MIXEDKEY
- malware — BINDCLOAK