Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments

Hackers are increasingly blending malicious traffic with legitimate services, and a newly uncovered campaign shows how far this tactic has evolved.

The activity has been attributed to a threat actor with links to East Asia, with researchers uncovering a previously undocumented malware suite comprising TELESHIM, MIXEDKEY, and a final-stage implant dubbed BINDCLOAK.

The campaign demonstrates a tightly orchestrated multi-stage attack chain designed for persistence, stealth, and selective execution.

Initial access begins with a weaponized ISO file containing a legitimate ASUS-signed binary, RegSchdTask.exe, used to sideload a malicious DLL, AsTaskSched.dll.

This technique allows execution within a trusted process context, effectively bypassing traditional security controls. Once loaded, the TELESHIM backdoor is deployed as the first-stage payload.

TELESHIM, a 32-bit C++ DLL compiled as recently as July 2026, introduces advanced obfuscation techniques including control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates.

These methods significantly complicate reverse engineering while concealing critical logic such as string decryption and execution flow.

The malware also implements anti-analysis mechanisms, including hypervisor detection via the CPUID instruction and RAM validation using WMI queries, terminating execution in virtualized environments commonly used by analysts.

A notable feature of TELESHIM is its abuse of the Telegram Bot API (https://api.telegram.org), which it uses for encrypted C2 communications.

By embedding bot tokens and chat identifiers within obfuscated code, the malware establishes a polling mechanism via HTTPS requests that mimic legitimate browser traffic.

This allows attacker communications to blend seamlessly into normal network activity, bypassing many network-based detection systems.

In July 2026, Zscaler ThreatLabz identified a sophisticated intrusion set targeting government entities across the Middle East, leveraging Telegram’s API as a covert command-and-control (C2) channel to evade detection.

Commands are delivered through Telegram messages and parsed using the open-source nlohmann JSON library (https://github.com/nlohmann/json). TELESHIM supports both command execution and payload delivery.

It validates instructions using the infected system’s MAC address, ensuring only intended victims execute specific commands. Data exfiltration and command output are encrypted and chunked to maintain stealth.

C2 Traffic Inside Telegram

ThreatLabz observed active post-compromise operations between July 7 and July 9, 2026, with attackers conducting systematic reconnaissance using native Windows utilities such as net user, ipconfig, and netstat.

The operators also staged persistence through scheduled tasks and validated connectivity using decoy domains like cert.hypersnet[.]com and ssl.blsouqs[.]com.

Following reconnaissance, attackers deploy the second-stage loader, MIXEDKEY, using DLL sideloading via a renamed legitimate binary (e.g., GoProAlertService.exe).

MIXEDKEY decrypts and reflectively loads the final payload, which is stored as an encrypted file mimicking Microsoft Platform Crypto Provider artifacts.

This environmental keying technique binds execution to the victim system by deriving the decryption key from the machine’s volume serial number, preventing analysis or reuse on unintended hosts.

The final implant, BINDCLOAK, is designed for long-term persistence and covert operations, with a deeper technical breakdown expected in ThreatLabz’s follow-up analysis.

Notably, attackers carefully select staging directories such as C:\ProgramData\Crypto\DSS\ to blend with legitimate system structures.

This campaign underscores a growing trend in adversary tradecraft: leveraging trusted cloud services and legitimate APIs to conceal malicious infrastructure.

Similar techniques have been observed in prior campaigns abusing platforms like Slack, Discord, and Microsoft Teams, but Telegram’s global reach and encrypted messaging capabilities make it particularly attractive for covert C2 operations.

The findings highlight the need for behavioral detection strategies that go beyond domain-based blocking.

Monitoring anomalous API usage patterns, enforcing strict application controls, and inspecting encrypted traffic flows are becoming critical defenses against such stealthy, multi-stage attacks.

Indicators Of Compromise (IOCs)

Hashes	Filename	Description
97124a93766be732e8fef5a56a5346a2C1f16e31ae71372ee45fa6fd6927c7b887a4e3f2789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd	Cooperation protocol for the exploration of petroleum and gas (English).zip	ZIP archive containing the ISO image
68926e6c958562deaae35de3d9f59de3Ccb2002fe8f5cc1f511d52309625b52d1c507421c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f	Cooperation protocol for the exploration of petroleum and gas (English).img	ISO image file
087499849115eb28c4364581d2b28d0986ee99f293a30720bcc898a4a8e391f93fb9be9532529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66	Agreement_on_the_Establishment_of_Common_Border_Offices_English (1).zip	ZIP archive containing the ISO image
B776eb638fbb535708fb92b12fcc17312377c47cfde148c2140faa7105628174f9c4d56ddb11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b	Agreement on the Establishment of Common Border Offices (English).img	ISO image file

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide