10 minhigh
Targeted Attack on Middle East Govts (Part 1) | ThreatLabz
Zscaler ThreatLabz identified a multi-stage attack campaign targeting Middle East government entities by a threat actor linked to East Asia. The attack chain uses an ISO file to deliver the TELESHIM backdoor via DLL sideloading of a legitimate ASUS executable, with TELESHIM abusing the Telegram API for C2 communication. A second-stage loader, MIXEDKEY, uses environmental keying based on the victim's volume serial number to decrypt and reflectively load the final BINDCLOAK C2 implant, with heavy obfuscation and anti-analysis techniques throughout.
Sens:▲ 24hConf:high
Showing defanged values
- domaincert[.]hypersnet[.]comBINDCLOAK C2 server beaconed to by the final stage implant
- domaincontacts[.]ftabnews[.]comDomain used by threat actor for network connectivity verification via ping during post-compromise activity
- domainssl[.]blsouqs[.]comDomain used by threat actor for network connectivity verification via ping during post-compromise activity
- filenameAsTaskSched.dllMalicious DLL sideloaded by legitimate RegSchdTask.exe (ASUSTek) to launch TELESHIM backdoor
- filenameC99F29AC08454855B3D538960BB2F34F.PCPKEYEncrypted BINDCLOAK payload file dropped to C:\ProgramData\Crypto\DSS\ and decrypted by MIXEDKEY using volume serial number keying
- filenamepthreadVC2.dllMalicious DLL sideloaded by legitimate GoPro binary to launch MIXEDKEY loader
- filenameshimgen.exeRenamed copy of legitimate RegSchdTask.exe staged in C:\programdata\shimgen_Data\ for persistence via scheduled task
- mutex----WebKitFormBoundary7MA4YWxkTrZu0gMutex checked by TELESHIM to ensure single instance execution on the victim machine
- urlhxxps://api[.]telegram[.]org/bot[BOT_TOKEN]/getUpdates?offset=[N]Telegram API URL pattern used by TELESHIM for C2 polling loop to fetch commands
Detection / Hunteropenrouter
What Happened
A hacker group believed to be operating from East Asia targeted government organizations in the Middle East using a sophisticated multi-step attack. The attackers disguised their malware inside seemingly legitimate software files to sneak past security tools. Once installed, the malware used the Telegram messaging service (a popular app) to receive commands from the attackers, making the malicious traffic look like normal internet activity. The attackers also designed their malware to only work on specific targeted computers by tying the decryption of the final payload to a unique identifier on each machine. Government agencies and organizations with similar profiles should review their systems for the indicators described and ensure their security tools can detect the file names and behaviors mentioned.
Key Takeaways
- Previously undocumented malware tooling — TELESHIM, MIXEDKEY, and BINDCLOAK — deployed in a multi-stage attack chain targeting Middle East government entities by a threat actor linked to East Asia.
- TELESHIM abuses the Telegram API for C2 communication, blending malicious traffic with legitimate internet activity and using encrypted bot tokens and chat IDs.
- MIXEDKEY uses environmental keying derived from the victim machine's volume serial number to decrypt the final BINDCLOAK payload, ensuring execution only on intended targets.
- Heavy code obfuscation via control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates across TELESHIM and MIXEDKEY to hinder reverse engineering.
- Anti-analysis techniques include CPUID-based hypervisor detection, WMI RAM speed checks, and I/O file stress tests to evade automated analysis environments.
Affected Systems
- Windows systems (32-bit and 64-bit)
- Government entities in the Middle East
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: ISO file delivered to victim containing legitimate RegSchdTask.exe (ASUSTek) that sideloads malicious AsTaskSched.dll
- Execution: TELESHIM backdoor executes via a 7-byte hook installed at offset 0x1394 in the host executable, redirecting execution to the implant payload
- Persistence: TELESHIM copies itself to C:\programdata\shimgen_Data\ and creates a scheduled task named 'shimgen' running every 6 minutes
- C2: TELESHIM abuses Telegram API for C2 communication, polling for commands and downloading next-stage payloads via encrypted HTTP GET requests
- Discovery: Threat actor performs system, network, and file reconnaissance using commands such as net user, tasklist, ipconfig /all, and directory enumeration
- Deployment: MIXEDKEY loader sideloaded via legitimate GoPro binary decrypts BINDCLOAK payload using volume serial number environmental keying and reflectively loads it
- C2: BINDCLOAK implant beacons to cert.hypersnet.com for final stage command and control
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not include any detection rules, queries, or signatures. It provides technical analysis and IOCs only.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | DLL sideloading via legitimate executables, scheduled task creation, and process execution via cmd.exe are visible to EDR. However, reflective loading of BINDCLOAK by MIXEDKEY and the use of Telegram API for C2 may be harder to distinguish from legitimate activity without behavioral analytics. |
| Network Visibility | Medium | TELESHIM C2 traffic to api.telegram.org blends with legitimate Telegram traffic. BINDCLOAK beacons to cert.hypersnet.com which could be detected via domain reputation or TLS fingerprinting. Ping commands to connectivity-check domains are visible in network logs. |
| Detection Difficulty | Hard | The use of legitimate binaries for DLL sideloading, Telegram API abuse for C2, environmental keying, and heavy obfuscation makes detection challenging. The Telegram C2 traffic requires behavioral analysis to distinguish from legitimate usage. The environmental keying prevents sandbox detonation and automated analysis. |
Required Log Sources
- Windows Event Logs (Sysmon Event ID 1 - Process Creation, Event ID 3 - Network Connection, Event ID 7 - Image Loaded, Event ID 11 - File Create, Event ID 22 - DNS Query)
- Windows Task Scheduler logs (Event ID 4698 - Scheduled Task Created)
- EDR process telemetry with command-line logging
- Network proxy/NGFW logs for HTTP(S) traffic analysis
- DNS resolution logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for legitimate ASUS RegSchdTask.exe or GoPro GoProAlertService.exe executing from non-standard directories such as C:\ProgramData, which may indicate DLL sideloading activity. | Sysmon Event ID 1 (Process Creation) with Image path filtering, Sysmon Event ID 7 (Image Loaded) for DLL load events | Execution | Low — these legitimate binaries are rarely found in ProgramData paths in normal enterprise environments |
| Consider hunting for scheduled tasks named 'shimgen' or 'Feedback' with execution intervals of 6 or 10 minutes, which correspond to TELESHIM and MIXEDKEY persistence mechanisms. | Windows Task Scheduler Event ID 4698, Sysmon Event ID 1 for schtasks.exe process creation with command-line arguments | Persistence | Low — these specific task names and intervals are uncommon in legitimate software |
| Consider hunting for processes making HTTP requests to api.telegram.org with unusual User-Agent strings or from non-browser processes, which may indicate TELESHIM C2 activity. | Network proxy logs, EDR network connection events, Sysmon Event ID 3 (Network Connection) correlated with process information | Command and Control | Medium — legitimate applications may use Telegram API; correlation with process identity and User-Agent string is important |
| Consider hunting for files with .PCPKEY extension or files named with hex-like patterns in C:\ProgramData\ subdirectories, which may indicate encrypted BINDCLOAK payload staging. | Sysmon Event ID 11 (File Create), EDR file creation events with path and extension filtering | Deployment | Low — .PCPKEY extension is non-standard and the naming pattern is unusual |
| Consider hunting for wmic.exe executing 'memorychip get speed' queries, which may indicate TELESHIM anti-analysis virtualization detection. | Sysmon Event ID 1 (Process Creation) with command-line logging for wmic.exe | Defense Evasion | Low — this specific WMI query is uncommon in normal administrative activity |
Control Gaps
- Traditional signature-based AV may miss the DLL sideloading technique using legitimate signed executables
- Network-based detection may not flag Telegram API traffic as malicious without behavioral analysis of process context
- Environmental keying prevents automated sandbox detonation from producing meaningful results
- Heavy CFF/MBA obfuscation may evade static analysis and YARA rules based on string or code patterns
- Reflective DLL loading by MIXEDKEY bypasses disk-based file scanning for the final payload
Key Behavioral Indicators
- RegSchdTask.exe or GoProAlertService.exe executing from C:\ProgramData\ subdirectories
- Scheduled tasks with names 'shimgen' or 'Feedback' and short interval execution (6-10 minutes)
- Non-browser processes making HTTPS connections to api.telegram.org
- Files with .PCPKEY extension created in C:\ProgramData\ subdirectories
- wmic.exe executing 'memorychip get speed' from non-standard parent processes
- Mutex named '----WebKitFormBoundary7MA4YWxkTrZu0g' created by suspicious processes
- Hardcoded User-Agent 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8)...' from Windows processes
False Positive Assessment
Low — the specific IOCs such as the mutex name, .PCPKEY file extension, scheduled task names, and DLL sideloading patterns from ProgramData paths are highly specific and unlikely to appear in legitimate activity. The main false positive risk is around Telegram API traffic detection, which requires process context correlation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for the IOCs identified in this report, including the mutex name, scheduled task names 'shimgen' and 'Feedback', and files with .PCPKEY extension.
- If your EDR supports it, consider blocking or alerting on network connections to cert.hypersnet.com, ssl.blsouqs.com, and contacts.ftabnews.com.
- Consider hunting for DLL sideloading activity by checking if RegSchdTask.exe or GoProAlertService.exe are executing from C:\ProgramData\ paths in your environment.
Infrastructure Hardening
- Evaluate whether your web proxy or NGFW can inspect and apply policy to traffic destined for api.telegram.org from non-browser processes, if applicable to your environment.
- Consider implementing application allow-listing for executables running from C:\ProgramData\ and other user-writable directories.
- If supported by your endpoint tooling, consider enabling behavioral detection rules for DLL sideloading scenarios involving legitimate signed binaries loading DLLs from non-standard paths.
User Protection
- Consider deploying EDR rules that alert on ISO file execution resulting in DLL sideloading activity, if your endpoint platform supports this capability.
- Evaluate whether your email gateway or web filter can block or sandbox ISO file delivery to end users, particularly targeting government sector employees.
- Consider enabling enhanced monitoring for scheduled task creation with short execution intervals (under 15 minutes) from non-standard paths.
Security Awareness
- Consider incorporating awareness training about the risks of opening unexpected ISO files or attachments from unknown sources.
- If applicable to your organization, consider reminding staff in government sectors about the elevated targeting risk and the importance of reporting suspicious system behavior.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- Urls:
hxxps://api[.]telegram[.]org/bot[BOT_TOKEN]/getUpdates?offset=[N]- Telegram API URL pattern used by TELESHIM for C2 polling loop to fetch commands
- File Paths:
C:\programdata\shimgen_Data\- Staging directory created by TELESHIM for copied legitimate executable and malicious DLLC:\ProgramData\Crypto\DSS\- Staging directory created by threat actor for MIXEDKEY and encrypted BINDCLOAK payload%TEMP%\CVR9EEA.tmp- Temporary file used by TELESHIM for I/O stress test anti-analysis technique
- Command Lines:
- Purpose: Persistence via scheduled task for next-stage payload execution | Tools:
schtasks.exe| Stage: Post-compromise |schtasks /create /f /sc minute /mo 10 /tn "Feedback" /tr - Purpose: RAM speed check for virtualization detection | Tools:
wmic.exe| Stage: Anti-analysis |wmic memorychip get speed - Purpose: Persistence via scheduled task for TELESHIM execution every 6 minutes | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /tn shimgen /tr - Purpose: Network connectivity verification to attacker-controlled domains | Tools:
ping.exe| Stage: Post-compromise |ping <hostname> -n
- Purpose: Persistence via scheduled task for next-stage payload execution | Tools:
- Other:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.31 (KHTML, like Gecko) Chrome/13.0.748.0 Safari/534.31- Hardcoded User-Agent string used by TELESHIM for Telegram API C2 HTTP requestsshimgen- Scheduled task name created by TELESHIM for persistence, running every 6 minutesFeedback- Scheduled task name created by threat actor for MIXEDKEY execution, running every 10 minutes
