TELESHIM Malware Uses Telegram Bots to Backdoor Middle East Government Networks

A suspected cyberespionage actor has targeted government organizations in the Middle East with a multi-stage Windows malware chain that uses Telegram bots for command-and-control communication.

The campaign deploys three previously undocumented tools called TELESHIM, MIXEDKEY, and BINDCLOAK. TELESHIM gives operators remote access, MIXEDKEY decrypts a victim-specific payload, and BINDCLOAK communicates with separate attacker-controlled infrastructure.

Zscaler ThreatLabz researchers observed the activity in July 2026 and captured post-compromise commands issued to infected systems. They assessed with moderate-to-high confidence that the operator works from East Asia, but did not connect the campaign to a known advanced persistent threat group.

What is the TELESHIM malware campaign?

TELESHIM is a 32-bit C++ backdoor that uses Telegram’s infrastructure to receive commands, return command output, and download additional payloads. The malware runs inside a legitimate ASUSTek application through DLL sideloading.

The observed attack chain starts with an ISO image containing the genuine ASUSTek program RegSchdTask.exe and a malicious DLL named AsTaskSched.dll. When the trusted application starts, it loads the attacker’s DLL from the same directory.

ThreatLabz identified three TELESHIM samples. Two older samples carried 2025 compilation timestamps, while the campaign’s newer variant carried a July 2026 timestamp and added encrypted strings and extensive code obfuscation.

Component	Role in the attack	Key technique
RegSchdTask.exe	Loads the first-stage malware	Legitimate ASUSTek executable used for DLL sideloading
TELESHIM	Provides initial remote control and payload delivery	Telegram Bot API command-and-control
MIXEDKEY	Decrypts and loads the final implant	Environmental keying tied to the victim’s volume serial number
BINDCLOAK	Acts as the final 64-bit command-and-control implant	Connects to an attacker-controlled domain

TELESHIM hides inside a trusted Windows process

When Windows invokes the malicious DLL, TELESHIM installs a seven-byte hook at a hardcoded offset inside the legitimate executable. The hook redirects execution into the backdoor while keeping the code inside the trusted application’s process.

The malware creates C:\ProgramData\shimgen_Data\ as a staging directory. It copies the legitimate executable there as shimgen.exe and places the malicious AsTaskSched.dll beside it.

TELESHIM then creates a scheduled task named shimgen. The task runs every six minutes, repeatedly launching the sideloading chain and restoring access after interruptions or system restarts.

Telegram bots act as the command channel

TELESHIM stores the Telegram hostname, bot token, and chat ID in encrypted form. At runtime, it decrypts those values and polls api.telegram.org for messages from the operator.

The malware uses the getUpdates method documented by the official Telegram Bot API. This lets the backdoor retrieve commands through a legitimate and widely used online service instead of connecting directly to an unfamiliar malware server.

TELESHIM obtains the infected computer’s MAC address and uses it as a unique identifier. It only runs commands containing the correct MAC address, allowing one Telegram bot to manage multiple infected systems while directing instructions to a particular victim.

• A control message can register the infected computer with the bot.
• Shell commands run through cmd.exe /C.
• Command output receives XOR encryption and Base64 encoding.
• Responses larger than 1,000 bytes are divided into smaller messages.
• Downloaded files are decrypted locally before execution.

Attackers can download and execute more payloads

For file delivery, the attacker sends a Telegram document with a caption containing the target machine’s MAC address and the intended destination path. TELESHIM ignores the file if the identifier does not match the infected computer.

After validation, TELESHIM uses the getFile function from the Telegram bot interface to retrieve the payload. It decrypts the downloaded content with a 44-byte rolling XOR key and creates a scheduled task to run it.

This design gives the operator a complete first-stage backdoor. It supports system registration, remote shell commands, encrypted result collection, file delivery, and execution without relying on a dedicated command server.

TELESHIM uses several anti-analysis techniques

Before performing its main operations, TELESHIM looks for signs of virtual machines and automated malware-analysis environments. It checks the processor’s hypervisor flag and terminates if the system reports a virtualized environment.

The malware also queries RAM speed through Windows Management Instrumentation. If the command returns zero or produces a value that cannot be parsed, TELESHIM treats the system as a possible virtual machine and exits.

Another check generates approximately 1 GB of disk activity by repeatedly writing and reading random data. This behavior can delay emulators and sandboxes long enough for automated analysis to time out.

• Control flow flattening makes program execution harder to follow.
• Mixed Boolean arithmetic adds complex calculations and junk instructions.
• Opaque predicates obscure which code paths the malware will use.
• Encrypted strings conceal commands, configuration data, and network details.
• Virtualization checks help the backdoor avoid security sandboxes.

Operators performed reconnaissance after gaining access

ThreatLabz recorded most of the observed command activity between July 7 and July 9, 2026. The attackers issued commands between 4:00 a.m. and 12:00 p.m. UTC, with most activity occurring from 7:00 a.m. to 11:00 a.m. UTC.

The operator collected usernames, the device hostname, running processes, network settings, DNS cache entries, active connections, and directory listings. These commands helped identify the victim environment and select locations for the next malware stage.

The attackers also tested connectivity to several domains and verified that newly created scheduled tasks worked correctly. ThreatLabz used this operational timing, the operator’s exposed public IP address, and the server locale to support its East Asia assessment.

Reconnaissance category	Observed commands	Purpose
System discovery	net user, tasklist, hostname	Identify users, processes, and the infected system
Network discovery	ipconfig /all, ipconfig /displaydns, netstat -ano	Collect network configuration, cached DNS data, and active connections
File discovery	dir commands targeting user and ProgramData directories	Choose staging locations and confirm payload deployment
Persistence	schtasks /create	Create a task named Feedback that runs every 10 minutes
Connection testing	ping commands	Check access to attacker-controlled infrastructure

MIXEDKEY locks BINDCLOAK to the intended victim

During the next stage, the attackers placed a legitimate GoPro executable beside a malicious DLL called pthreadVC2.dll. Launching the trusted program sideloaded the malicious MIXEDKEY loader.

MIXEDKEY reads an encrypted file disguised as Microsoft Platform Crypto Provider data. It retrieves the infected system’s four-byte volume serial number, repeats it to create a 20-byte key, and applies two layers of XOR decryption.

This environmental keying prevents the final payload from decrypting correctly on another computer. Malware analysts who recover the encrypted file may remain unable to examine BINDCLOAK without the original victim’s volume serial number.

BINDCLOAK provides the final command channel

After decrypting the payload, MIXEDKEY reflectively loads it into memory. The resulting 64-bit C++ implant, which ThreatLabz named BINDCLOAK, connects to cert.hypersnet[.]com.

The first ThreatLabz campaign report concentrates on TELESHIM, MIXEDKEY, and the observed post-compromise activity. Zscaler plans to publish a separate technical analysis of BINDCLOAK.

No evidence currently links the campaign to a named APT group. The available assessment only places the operator in East Asia with moderate-to-high confidence and should not be interpreted as attribution to a particular country.

How organizations can detect the campaign

Security teams should investigate unexpected access to Telegram’s API from government workstations and servers. Telegram traffic deserves additional scrutiny where users and business applications have no reason to contact the service.

Defenders should also watch for trusted executables loading DLLs from recently created or unusual directories. Relevant examples include RegSchdTask.exe loading AsTaskSched.dll and a GoPro executable loading pthreadVC2.dll.

Scheduled tasks named shimgen or Feedback provide additional detection opportunities. Analysts should correlate these tasks with new files under ProgramData, unusual child processes, Telegram API requests, and connections to the BINDCLOAK domain.

• Block or monitor Telegram API access where the service has no approved use.
• Alert when trusted applications load unsigned DLLs from user-writable locations.
• Review scheduled tasks created to run every six or ten minutes.
• Search endpoints for the published SHA-256 indicators.
• Inspect C:\ProgramData\shimgen_Data\ and C:\ProgramData\Crypto\DSS\.
• Block and investigate connections to cert.hypersnet[.]com.
• Review ISO and IMG files delivered with government-themed filenames.

Indicators of compromise

Type	Indicator	Description
SHA-256	789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd	Petroleum and gas cooperation ZIP archive
SHA-256	c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f	Petroleum and gas cooperation IMG file
SHA-256	32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66	Common Border Offices ZIP archive
SHA-256	db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b	Common Border Offices IMG file
SHA-256	5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d	New TELESHIM variant, AsTaskSched.dll
SHA-256	cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be	Old TELESHIM variant, AsTaskSched.dll
SHA-256	0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9	Old TELESHIM variant, dlpprem64.dll
SHA-256	3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f	MIXEDKEY reflective loader, pthreadVC2.dll
SHA-256	3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d	BINDCLOAK implant
C2 domain	cert.hypersnet[.]com	BINDCLOAK command-and-control server

FAQ