Loading malware…
TELESHIM is a previously undocumented 32-bit Windows backdoor used in a multi-stage cyberespionage campaign targeting government entities in the Middle East. The malware has been associated with a suspected East Asia-linked threat actor and was deployed as an early-stage implant before the MIXEDKEY loader and the BINDCLOAK backdoor. It was delivered through DLL sideloading using legitimate-looking Windows executables packaged in ISO-based lure chains.
TELESHIM is notable for abusing the Telegram API for command-and-control communications, allowing operator traffic to blend with legitimate internet activity. It polls for tasking, validates operator messages, and can register infected hosts using host-specific identifiers. Supported functionality includes execution of shell commands, chunked exfiltration of command output, retrieval of additional payloads, and launching secondary components through scheduled-task execution. The malware also establishes persistence by copying itself alongside a sideloading host executable and creating recurring scheduled tasks.
The implant employs extensive obfuscation and anti-analysis measures. Reported protections include encrypted strings, control-flow obfuscation, mixed boolean arithmetic, opaque predicates, hypervisor detection, and environmental checks intended to hinder sandboxing and reverse engineering. TELESHIM also performs reconnaissance sufficient to identify and manage infected systems, including collection of host identifiers such as the MAC address. In observed operations, it served as the initial backdoor that enabled follow-on staging and post-compromise activity against government targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Download and execute messages, which are used to download and run secondary payloads as scheduled tasks
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
The campaign targeted government entities in the Middle East, with a particular focus on the energy sector. Attackers used a multi-stage chain that began with an ISO file and legitimate-looking Windows components before delivering TELESHIM, MIXEDKEY, and finally BINDCLOAK.
Both TELESHIM and MIXEDKEY have been found to rely on heavy code obfuscation techniques, including string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to deter reverse engineering efforts.
The final payload is encrypted using two layers of XOR encryption... MIXEDKEY decrypts the payload and reflectively loads it.
TELESHIM also employs an array of methods to detect the presence of virtualization-based analysis environments. Some of these are listed below - Hypervisor detection using CPUID RAM speed check using the Windows Management Instrumentation (WMI)
Network reconnaissance ipconfig /all ipconfig /displaydns netstat -ano Discover information about the system's network configuration and active network connections.
System reconnaissance net user ... Discover information about current users
netstat -ano ... Discover information about the system’s network configuration and active network connections.
tasklist ... Discover information about current users, list of running processes, and the hostname of the infected machine.
hostname ... Discover information about current users, list of running processes, and the hostname of the infected machine.
File reconnaissance dir c:\Users dir c:\Users\ \desktop dir c:\Users\ \Downloads dir C:\ProgramData\Crypto\DSS\ dir C:\ProgramData\ dir C:\ProgramData\Lenovo dir C:\ProgramData\Intel
TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic
In the next phase, TELESHIM enters a polling loop by sending HTTP GET requests to the following URL to fetch updates: https://api.telegram.org/bot /getUpdates?offset=
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor discussed in prior coverage as part of the related threat activity.
An earlier component in the intrusion chain that helped operators manage compromised systems via Telegram bot backdoor controllers.
A backdoor discussed in Part 1 of the research and mentioned here only as prior context for the broader campaign.
A backdoor discussed in Part 1 of the same campaign analysis and connected to the broader multi-stage intrusion chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.