ThreatLabz Details TELESHIM Malware Campaign Targeting Middle East Government Entities
Summary
ThreatLabz analyzes a July 2026 campaign targeting Middle East government entities, detailing the TELESHIM backdoor’s Telegram-based C2, post-compromise activity, and the MIXEDKEY loader that decrypts and loads BINDCLOAK.
Key points
- The campaign began with an ISO containing a legitimate ASUS executable that sideloaded the malicious TELESHIM DLL.
- TELESHIM used obfuscation, virtualization checks, and heavy file I/O to hinder analysis, then established persistence through a scheduled task.
- The backdoor used Telegram’s API for C2, registering infected systems by MAC address and accepting commands and payload downloads.
- Operators ran system, network, and file reconnaissance commands and deployed additional payloads between July 7 and July 9, 2026.
- MIXEDKEY sideloaded alongside a legitimate binary, decrypted an encrypted payload using a key derived from the infected machine’s volume serial number, and reflectively loaded it.
- The final-stage BINDCLOAK implant beacons to cert.hypersnet[.]com; the article says its detailed analysis will appear in Part 2.
Article Details
- Attack Vectors
- An ISO file contained a legitimate ASUSTek RegSchdTask.exe that sideloaded the malicious AsTaskSched.dll.
- TELESHIM established persistence with a scheduled task and used the Telegram API for command-and-control, including command execution and file downloads.
- The operator deployed MIXEDKEY alongside legitimate binaries; a legitimate binary sideloaded pthreadVC2.dll, which decrypted and reflectively loaded the BINDCLOAK payload.
- BINDCLOAK was encrypted with a key derived from the infected machine's volume serial number.
- Defensive Notes
- Monitor for scheduled tasks named shimgen and Feedback, including tasks that run every 6 or 10 minutes.
- Investigate suspicious DLL sideloading involving RegSchdTask.exe and pthreadVC2.dll, and unexpected payloads staged under C:\ProgramData\.
- Monitor endpoints for command execution and file downloads initiated by processes communicating with the Telegram API.
- TELESHIM checks for virtualization-based analysis environments and performs intensive temporary-file I/O, which may hinder sandbox analysis.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cert[.]hypersnet[.]com | BINDCLOAK command-and-control domain; also used by the operator to verify network connectivity. |
| MD5 | 087499849115eb28c4364581d2b28d09 | Hash of the ZIP archive containing the ISO image, listed as a campaign file indicator. |
| MD5 | 28b47bdf16d7af6f8ec21218eac9145a | Hash of dlpprem64.dll, identified as old TELESHIM. |
| MD5 | 3f60d53a2b5737d77e058d9e33cbe9eb | Hash of the old TELESHIM AsTaskSched.dll, listed as a campaign file indicator. |
| MD5 | 68926e6c958562deaae35de3d9f59de3 | Hash of the ISO image file, listed as a campaign file indicator. |
| MD5 | 78a4f8574830bf7fbaf63d7da09be2b8 | Hash of pthreadVC2.dll, identified as the MIXEDKEY reflective PE loader. |
| MD5 | 7a14a99d70d42d3f7bf72f843185fc07 | Hash of the BINDCLOAK C2 implant, listed as a campaign file indicator. |
| MD5 | 7cbc51ada1a4aec88660ec32c408114b | Hash of the new TELESHIM AsTaskSched.dll, listed as a campaign file indicator. |
| MD5 | 97124a93766be732e8fef5a56a5346a2 | Hash of the ZIP archive containing the ISO image, listed as a campaign file indicator. |
| MD5 | b776eb638fbb535708fb92b12fcc1731 | Hash of the ISO image file, listed as a campaign file indicator. |
| SHA1 | 1099bf51e53bd5fb32401edb4e0be841d8486b19 | Hash of the old TELESHIM AsTaskSched.dll, listed as a campaign file indicator. |
| SHA1 | 2377c47cfde148c2140faa7105628174f9c4d56d | Hash of the ISO image file, listed as a campaign file indicator. |
| SHA1 | 577b1cc894636f4ac5ad670b0079b9b7ade137c3 | Hash of the BINDCLOAK C2 implant, listed as a campaign file indicator. |
| SHA1 | 86ee99f293a30720bcc898a4a8e391f93fb9be95 | Hash of the ZIP archive containing the ISO image, listed as a campaign file indicator. |
| SHA1 | c1f16e31ae71372ee45fa6fd6927c7b887a4e3f2 | Hash of the ZIP archive containing the ISO image, listed as a campaign file indicator. |
| SHA1 | ccb2002fe8f5cc1f511d52309625b52d1c507421 | Hash of the ISO image file, listed as a campaign file indicator. |
| SHA1 | ee287d6a09295502ab2407aec336f9f0d8477d68 | Hash of pthreadVC2.dll, identified as the MIXEDKEY reflective PE loader. |
| SHA1 | f46c01a5be2e08e36d4ec3302a8650a6ed25ec14 | Hash of the new TELESHIM AsTaskSched.dll, listed as a campaign file indicator. |
| SHA1 | fee6806c96f87bf1e240a2eb6fd7e045101d58d3 | Hash of dlpprem64.dll, identified as old TELESHIM. |
| SHA256 | 0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9 | Hash of dlpprem64.dll, identified as old TELESHIM. |
| SHA256 | 32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66 | Hash of the ZIP archive containing the ISO image, listed as a campaign file indicator. |
| SHA256 | 3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d | Hash of the BINDCLOAK C2 implant, listed as a campaign file indicator. |
| SHA256 | 3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f | Hash of pthreadVC2.dll, identified as the MIXEDKEY reflective PE loader. |
| SHA256 | 5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d | Hash of the new TELESHIM AsTaskSched.dll, listed as a campaign file indicator. |
| SHA256 | 789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd | Hash of the ZIP archive containing the ISO image, listed as a campaign file indicator. |
| SHA256 | c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f | Hash of the ISO image file, listed as a campaign file indicator. |
| SHA256 | cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be | Hash of the old TELESHIM AsTaskSched.dll, listed as a campaign file indicator. |
| SHA256 | db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b | Hash of the ISO image file, listed as a campaign file indicator. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe operator runs ipconfig /all to inspect network configuration.T1027 · Obfuscated Files or InformationTELESHIM and MIXEDKEY use control-flow flattening, mixed boolean arithmetic, and opaque predicates to obfuscate code.T1033 · System Owner/User DiscoveryThe operator runs net user to discover user information on infected systems.T1049 · System Network Connections DiscoveryThe operator runs netstat -ano to inspect active network connections.T1053.005 · Scheduled TaskTELESHIM and the operator create scheduled tasks named shimgen and Feedback to launch payloads periodically.T1057 · Process DiscoveryThe operator runs tasklist to enumerate processes on infected systems.T1059.003 · Windows Command ShellTELESHIM executes operator-supplied commands using cmd.exe /C.T1071.001 · Web ProtocolsTELESHIM communicates with its C2 through HTTP requests to the Telegram API.T1082 · System Information DiscoveryThe operator runs hostname to obtain the infected machine's hostname.T1083 · File and Directory DiscoveryThe operator lists user and ProgramData directories to inspect files and select payload staging locations.T1105 · Ingress Tool TransferTELESHIM fetches files through the Telegram bot API, decrypts the downloaded file, and schedules it to launch.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypts strings and encrypted payload content at runtime.T1497.001 · System ChecksTELESHIM checks the CPUID hypervisor bit and RAM speed to detect virtualization-based analysis environments.T1574.002 · DLL Side-LoadingA legitimate RegSchdTask.exe sideloads the malicious AsTaskSched.dll; later, a legitimate binary sideloads pthreadVC2.dll.T1620 · Reflective Code LoadingMIXEDKEY reflectively loads the decrypted PE payload.
Malware
BINDCLOAKactivity and uncovered previously undocumented malware tooling, including TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign used a multi-stage attack chain to establish and maintain access on infected systems, withMIXEDKEYpost-compromise activity and uncovered previously undocumented malware tooling, including TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign used a multi-stage attack chain to establish and maintain access onTELESHIMcaptured post-compromise activity and uncovered previously undocumented malware tooling, including TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign used a multi-stage attack chain to establish and maintain access
Products
Microsoft WindowsTELESHIM is a 32-bit C++ Windows DLL that is used in the first stage of the attack. ThreatLabz identified three unique instances of TELESHIM. While two of these instances were compiled in 2025, the variant used in thisTelegrammulti-stage attack chain to establish and maintain access on infected systems, with TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic.