Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments

Hackers are increasingly blending malicious traffic with legitimate services, and a newly uncovered campaign shows how far this tactic has evolved.

The activity has been attributed to a threat actor with links to East Asia, with researchers uncovering a previously undocumented malware suite comprising TELESHIM, MIXEDKEY, and a final-stage implant dubbed BINDCLOAK.

The campaign demonstrates a tightly orchestrated multi-stage attack chain designed for persistence, stealth, and selective execution.

Initial access begins with a weaponized ISO file containing a legitimate ASUS-signed binary, RegSchdTask.exe, used to sideload a malicious DLL, AsTaskSched.dll.

This technique allows execution within a trusted process context, effectively bypassing traditional security controls. Once loaded, the TELESHIM backdoor is deployed as the first-stage payload.

TELESHIM, a 32-bit C++ DLL compiled as recently as July 2026, introduces advanced obfuscation techniques including control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates.

These methods significantly complicate reverse engineering while concealing critical logic such as string decryption and execution flow.

The malware also implements anti-analysis mechanisms, including hypervisor detection via the CPUID instruction and RAM validation using WMI queries, terminating execution in virtualized environments commonly used by analysts.

A notable feature of TELESHIM is its abuse of the Telegram Bot API (https://api.telegram.org), which it uses for encrypted C2 communications.

By embedding bot tokens and chat identifiers within obfuscated code, the malware establishes a polling mechanism via HTTPS requests that mimic legitimate browser traffic.

This allows attacker communications to blend seamlessly into normal network activity, bypassing many network-based detection systems.

In July 2026, Zscaler ThreatLabz identified a sophisticated intrusion set targeting government entities across the Middle East, leveraging Telegram’s API as a covert command-and-control (C2) channel to evade detection.

Commands are delivered through Telegram messages and parsed using the open-source nlohmann JSON library (https://github.com/nlohmann/json). TELESHIM supports both command execution and payload delivery.

It validates instructions using the infected system’s MAC address, ensuring only intended victims execute specific commands. Data exfiltration and command output are encrypted and chunked to maintain stealth.

C2 Traffic Inside Telegram

ThreatLabz observed active post-compromise operations between July 7 and July 9, 2026, with attackers conducting systematic reconnaissance using native Windows utilities such as net user, ipconfig, and netstat.

The operators also staged persistence through scheduled tasks and validated connectivity using decoy domains like cert.hypersnet[.]com and ssl.blsouqs[.]com.

Following reconnaissance, attackers deploy the second-stage loader, MIXEDKEY, using DLL sideloading via a renamed legitimate binary (e.g., GoProAlertService.exe).

MIXEDKEY decrypts and reflectively loads the final payload, which is stored as an encrypted file mimicking Microsoft Platform Crypto Provider artifacts.

This environmental keying technique binds execution to the victim system by deriving the decryption key from the machine’s volume serial number, preventing analysis or reuse on unintended hosts.

The final implant, BINDCLOAK, is designed for long-term persistence and covert operations, with a deeper technical breakdown expected in ThreatLabz’s follow-up analysis.

Notably, attackers carefully select staging directories such as C:\ProgramData\Crypto\DSS\ to blend with legitimate system structures.

This campaign underscores a growing trend in adversary tradecraft: leveraging trusted cloud services and legitimate APIs to conceal malicious infrastructure.

Similar techniques have been observed in prior campaigns abusing platforms like Slack, Discord, and Microsoft Teams, but Telegram’s global reach and encrypted messaging capabilities make it particularly attractive for covert C2 operations.

The findings highlight the need for behavioral detection strategies that go beyond domain-based blocking.

Monitoring anomalous API usage patterns, enforcing strict application controls, and inspecting encrypted traffic flows are becoming critical defenses against such stealthy, multi-stage attacks.

Indicators Of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide