"The campaign used a multi-stage attack chain to establish and maintain access on infected systems, with TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic," Sudeep Singh, senior manager of APT research at Zscaler ThreatLabz, said.
TELESHIM’s multi-stage infection path
Zscaler ThreatLabz says the intrusion sequence begins with an ISO file that contains a legitimate executable named RegSchdTask.exe. That executable is used to sideload a rogue DLL called AsTaskSched.dll, which in turn drops a 32-bit Windows backdoor the researchers have named TELESHIM. TELESHIM leverages the Telegram API as its C2 channel to retrieve follow-on components and to mix its traffic with legitimate internet communications.
TELESHIM supports two distinct C2 message types: control messages, which register the infected host by sending the host's MAC address and execute commands while exfiltrating results (splitting outputs into chunks if larger than 1,000 bytes); and download-and-execute messages, which pull secondary payloads down and run them as scheduled tasks. The final payload is protected behind two layers of XOR encryption, the second using environmental keying where the decryption key is derived from the infected machine's volume serial number — a mechanism intended to limit detonation to intended targets.
MIXEDKEY, DLL sideloading, and decryption of PCPKEY
Two next-stage payloads trigger a second DLL side-loading chain involving GoProAlertService.exe and pthreadVC2.dll. The pthreadVC2.dll acts as a reflective loader the researchers call MIXEDKEY; it decrypts a file named C99F29AC08454855B3D538960BB2F34F.PCPKEY and executes its contents. Both TELESHIM and MIXEDKEY employ extensive code obfuscation designed to thwart analysis.
- Documented obfuscation techniques include string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates.
- TELESHIM also performs virtualization-detection checks, such as hypervisor detection using CPUID and a RAM speed check via Windows Management Instrumentation (WMI).
BINDCLOAK C2 implant and the external server cert.hypersnet[.]com
The final stage of the sequence, according to ThreatLabz, deploys BINDCLOAK: a 64‑bit C2 implant written in C++ that contacts an external server at cert.hypersnet[.]com. Zscaler observed post-compromise operator activity — system, user, and network reconnaissance commands and additional payload deliveries — chiefly between July 7, 2026 and July 9, 2026.
Notably, the C2 commands were executed only during a restricted daily window, between 4 a.m. and 12 p.m. UTC, with most activity concentrated from 7 a.m. to 11 a.m. UTC.
Assessment: East Asia origin and no firm attribution
Zscaler assessed with moderate-to-high confidence that the campaign originates from East Asia. That assessment is based on the threat actor's public IP address, the system locale configured on their Windows server, the IP geolocation, and the operators' active hours. The company did not attribute the activity to any known threat actor or group at this stage.
Singh framed the operation as part of broader trends observed by researchers: efforts to evade endpoint detection and response (EDR), blending malicious communications with trusted platforms, and the use of heavy obfuscation techniques such as MBA and CFF to slow reverse engineering.
What this means for technologists, policymakers, and affected governments
- Technologists and security teams: monitor for DLL side‑loading patterns (RegSchdTask.exe / AsTaskSched.dll; GoProAlertService.exe / pthreadVC2.dll), unusual use of the Telegram API for outbound traffic, and staged decryption behavior tied to machine-specific artifacts (volume serial numbers). The chunked exfiltration behavior (outputs split at 1,000 bytes) and restricted operational hours may be observable in network and logging telemetry.
- Policymakers and regulators: the campaign’s cross-border footprint — coupled with Zscaler’s moderate-to-high confidence assessment pointing to East Asia and the targeting of Middle East government entities — may prompt inquiries about platform abuse and international incident coordination, especially given the use of a public messaging API for C2.
- Affected governments in the Middle East: entities that experienced intrusions between July 7 and July 9, 2026 should search for indicators consistent with TELESHIM, MIXEDKEY, and BINDCLOAK activity, including the cert.hypersnet[.]com callback, the presence of the noted executables and DLLs, and the described timing and registration behaviors.
The operation combines tried-and-true binary sideloading with modern tactics: abusing a mainstream messaging API to hide C2 traffic and locking final payloads to specific machines. Zscaler’s findings leave a clear signature set — filenames, callback host, timing, and encryption behavior — that defenders can use to hunt for infections. At the same time, the environmental keying and layered obfuscation show a deliberate effort to restrict impact to selected targets and to slow analysis, leaving open the question of whether similar tooling will reappear with altered delivery or callback infrastructure.
Source: https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html
