C2 in Attacks Against Middle East Governments

Overview

Cybersecurity researchers at Zscaler ThreatLabz have uncovered a new campaign targeting government entities in the Middle East, deploying three previously unreported malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign, attributed with moderate-to-high confidence to an East Asia–based adversary, demonstrates advanced evasion techniques and abuse of trusted platforms like Telegram for command-and-control (C2).

Attack Chain Breakdown

• Initial Access: Delivered via an ISO file containing a legitimate executable (RegSchdTask.exe) used to sideload a rogue DLL (AsTaskSched.dll).
• TELESHIM Backdoor: A 32‑bit Windows backdoor that leverages the Telegram API for C2, blending malicious traffic with legitimate communications.
• Secondary Payloads: Triggered by a second DLL sideloading chain (GoProAlertService.exe + pthreadVC2.dll), loading MIXEDKEY, a reflective loader that decrypts hidden payloads.
• Final Stage: Deployment of BINDCLOAK, a 64‑bit C2 implant written in C++ that connects to cert.hypersnet[.]com

Technical Highlights

• Obfuscation Techniques:
  • String encryption.
  • Control Flow Flattening (CFF).
  • Mixed Boolean Arithmetic (MBA).
  • Opaque predicates to hinder reverse engineering.
• EDR Evasion: TELESHIM detects virtualization environments via:
  • CPUID hypervisor checks.
  • RAM speed checks using WMI.
• C2 Communication:
  • Control messages: register infected hosts, execute commands, exfiltrate results.
  • Download/execute messages: fetch secondary payloads as scheduled tasks.
• Environmental Keying: Final payload locked behind two layers of XOR encryption, with the second layer tied to the infected machine’s volume serial number, ensuring detonation only on intended targets.

Campaign Activity

• Observed July 7–9, 2026, with C2 commands executed between 4 a.m. and 12 p.m. UTC (peak activity between 7–11 a.m.).
• Post-compromise activity included:
  • System reconnaissance.
  • User and network enumeration.
  • Delivery of next-stage payloads.

Broader Trends Reflected

• Abuse of trusted platforms — leveraging Telegram to blend in with legitimate traffic.
• EDR evasion — virtualization detection and obfuscation.
• Code obfuscation — MBA and CFF hinder reverse engineering.
• Targeted espionage — focused on government entities in geopolitically sensitive regions.

Defender Recommendations

• Monitor Telegram API traffic for anomalies.
• Inspect sideloading chains involving executables like RegSchdTask.exe and GoProAlertService.exe.
• Hunt for obfuscated payloads using MBA/CFF patterns.
• Deploy behavioral detection for virtualization checks and environmental keying.
• Review system logs for anomalous scheduled tasks and outbound connections to suspicious domains.

Expert in the Cloud Insight

The TELESHIM campaign highlights how state-linked adversaries weaponize trusted platforms like Telegram to evade detection. By combining multi-stage sideloading, obfuscation, and environmental keying, attackers ensure persistence and stealth. For defenders, the lesson is clear: traditional signature-based detection is insufficient — organizations must adopt behavioral monitoring and proactive threat hunting to counter advanced campaigns targeting government and critical infrastructure.