Loading malware…
MIXEDKEY is a 64-bit Windows DLL loader used in a multistage cyberespionage campaign targeting government entities in the Middle East in July 2026. It operates after the TELESHIM backdoor and decrypts and reflectively loads the BINDCLOAK implant during post-compromise activity. Attackers execute MIXEDKEY through DLL sideloading using a legitimate GoPro executable. The campaign has not been attributed to a named threat group.
MIXEDKEY protects its payload with two layers of XOR encryption, including environmental keying tied to the infected device. It retrieves the device's volume serial number through the Windows API and derives a 20-byte rolling XOR key from that value. This device-specific dependency restricts successful payload decryption to the intended host and impedes analysis on other systems. The decrypted payload has its executable signature stripped and is reflectively loaded into memory. MIXEDKEY also uses mixed Boolean-arithmetic obfuscation and runtime string construction to hinder reverse engineering.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
The campaign targeted government entities in the Middle East, with a particular focus on the energy sector. Attackers used a multi-stage chain that began with an ISO file and legitimate-looking Windows components before delivering TELESHIM, MIXEDKEY, and finally BINDCLOAK.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Both TELESHIM and MIXEDKEY have been found to rely on heavy code obfuscation techniques, including string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to deter reverse engineering efforts.
The final payload is encrypted using two layers of XOR encryption... MIXEDKEY decrypts the payload and reflectively loads it.
The threat actor leveraged environmental keying by encrypting BINDCLOAK using a decryption key derived from the infected machine’s volume serial number.
The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.
Zscaler said in a report that the malware was decrypted and reflectively loaded by MIXEDKEY during post-compromise activity.
The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.
The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.
Download and execute messages... uses document.file_id parsed from the JSON response to fetch the file via /bot<TOKEN>/getFile?file_id=<FILE_ID>. The downloaded file is decrypted... and scheduled tasks are used to launch the dropped binary.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.