TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments

Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.

According to Zscaler ThreatLabz reporting, an East Asia-linked threat actor is conducting a multi-stage cyber-espionage campaign against Middle East government entities using custom malware families TELESHIM, MIXEDKEY, and BINDCLOAK, with TELESHIM abusing the Telegram API for command-and-control to blend into normal chat traffic.[1][4][5][6] The attack chain relies on spear-phishing ISO images, DLL sideloading of a legitimate executable, strong obfuscation, and environmental keying to maintain persistent, stealthy access on government systems.[1][2][5][6] From a RealGround perspective, this illustrates how widely-used consumer messaging infrastructure can be repurposed as resilient C2, bypassing traditional network controls and threatening AI-enabled monitoring or analytics that assume benign collaboration traffic. Practical implications include the need for continuous red teaming of SOC/AI detection pipelines against messaging-app C2 patterns, AI CISO-led policies on allowing/monitoring Telegram in sensitive networks, and supply-chain scrutiny of legitimate binaries that can be abused for DLL sideloading.