TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Summary: Zscaler ThreatLabz reported a campaign against Middle East government entities that deploys three previously unreported malware families - TELESHIM, MIXEDKEY, and BINDCLOAK - starting with an ISO file containing a legitimate executable, RegSchdTask.exe, used to sideload a rogue DLL, AsTaskSched.dll. TELESHIM uses the Telegram API for command-and-control to blend with legitimate traffic, and the final payload is locked behind two layers of XOR encryption, the second keyed to the infected machine's volume serial number so it detonates only on intended targets.
What you should know: The operator's C2 commands ran only between 4 a.m. and 12 p.m. UTC, with most activity between 7 a.m. and 11 a.m. - a working-hours pattern that, combined with IP geolocation and system locale, led researchers to assess with moderate-to-high confidence the actor originates from East Asia, though no known group has been named.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026