[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsI3Pi_viJdbJkXLOf9J4OC810PK93e4s5kgy0lDJ-OQ":3},{"article":4,"iocs":48,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"77991445-e459-4838-98b8-1f479bf55bd6","TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments","teleshim-abuses-telegram-for-c2-in-attacks-against-middle-east-governments-e5e6a5","Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.","A threat actor with ties to East Asia has been observed targeting government entities in the Middle East using previously unknown malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign leverages Telegram for command-and-control (C2) communication and employs sophisticated obfuscation techniques to evade detection and analysis.","New malware families TELESHIM, MIXEDKEY, and BINDCLOAK used in attacks against Middle East governments.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fteleshim-abuses-telegram-for-c2-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEikuWOQRYm6WQ1zHmOlYkI7jlVOUUKGBIlo68iWyUVuaZ5n3i7ODu8DYpntAk2aGZQ_7LsYpXpp5v0PcQMLxP8LQOajtKl-WaDBb7_wDpo8P3-iCcAwr74JY4rXNeHJJv9h6EB447wPEnrZE08YfDO_WI9N4B_C1lPvxILfvv00Z_J8yHntLSfNYbPVCDjS\u002Fs1600\u002Ftelegram-c2.jpg","2026-07-27T08:48:47+00:00","2026-07-27T10:00:19.67504+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Zscaler","vendor",{"name":21,"type":22},"TELESHIM","product",{"name":24,"type":22},"MIXEDKEY",{"name":26,"type":22},"BINDCLOAK",{"name":28,"type":29},"Telegram","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},[49,53,55,57],{"type":50,"value":51,"context":52},"domain","cert.hypersnet[.]com","C2 domain used by BINDCLOAK implant",{"type":45,"value":21,"context":54},"32-bit Windows backdoor using Telegram for C2",{"type":45,"value":24,"context":56},"Reflective loader used to decrypt and execute payloads",{"type":45,"value":26,"context":58},"64-bit C2 implant written in C++",[18,21,24],{"controls":61,"vendors":143},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":34,"name":92,"problem":93,"products":94},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":120,"name":121,"problem":122,"products":123},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[124,130,138],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":139,"product_name":140,"url":141,"description":142},"prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"zscaler","\u002Fvendor-logos\u002Fzscaler.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":164},"teleshim-malware-abuses-telegram-for-c2-against-middle-east-governments","TELESHIM Malware Abuses Telegram for C2 Against Middle East Governments","A suspected East Asian threat actor deployed novel malware families (TELESHIM, MIXEDKEY, BINDCLOAK) against Middle Eastern government entities, cleverly using Telegram's legitimate infrastructure as a command-and-control channel to blend malicious traffic with normal communications. This technique is particularly dangerous because blocking Telegram outright may be operationally disruptive, and standard perimeter defenses often fail to flag traffic to trusted messaging platforms. The use of sophisticated obfuscation techniques further delayed detection and analysis, extending the attacker's dwell time inside victim networks. This campaign highlights the growing trend of adversaries weaponizing trusted consumer platforms to evade detection, making behavioral and anomaly-based monitoring critical.",[154,155,156,157,158,159,160,161,162,163],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-6: Audit Record Review and Analysis","NIST SP 800-53 IR-4: Incident Handling","MITRE ATT&CK T1102: Web Service (C2 via legitimate external web services)","MITRE ATT&CK T1027: Obfuscated Files or Information","ISO\u002FIEC 27001 A.13.1: Network Security Management",{}]