Loading malware…
TELESHIM is a 32-bit Windows backdoor written in C++ that uses Telegram’s Bot API for command-and-control, remote command execution, and delivery of additional payloads. It was observed in a July 2026 cyberespionage campaign targeting government entities in the Middle East, serving as the first-stage implant in an infection chain that subsequently deployed the MIXEDKEY loader and BINDCLOAK backdoor. The campaign was not attributed to a named threat group.
The infection chain begins with an ISO disk image containing a legitimate ASUSTek executable and a malicious companion DLL. The executable loads TELESHIM through DLL sideloading. Associated lure archives use petroleum, gas, and border-agreement themes. TELESHIM copies its components to a staging directory and creates a recurring scheduled task for persistence.
TELESHIM identifies infected hosts by their network adapter MAC address, polls a designated Telegram chat, and validates the chat identifier before processing messages. It executes host-addressed commands through the Windows command interpreter and returns encrypted command output through Telegram. It can also retrieve encrypted files through the bot interface, decrypt them locally, and launch additional payloads using scheduled tasks. Operators used this access for system, user, process, network, and file discovery and to stage subsequent components.
TELESHIM blends its command traffic with communications to a legitimate online service and employs extensive anti-analysis measures. These include encrypted strings, control-flow flattening, mixed Boolean arithmetic, opaque predicates, hypervisor detection, memory-speed checks through Windows Management Instrumentation, and high-volume disk activity intended to impede analysis.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Download and execute messages, which are used to download and run secondary payloads as scheduled tasks
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
The campaign targeted government entities in the Middle East, with a particular focus on the energy sector. Attackers used a multi-stage chain that began with an ISO file and legitimate-looking Windows components before delivering TELESHIM, MIXEDKEY, and finally BINDCLOAK.
When the host executable reaches that point in its startup, the trampoline fires and execution enters the implant's main payload. By redirecting execution via an installed hook, the code is executed in the context of the host executable to evade security tools.
Download and execute messages, which are used to download and run secondary payloads as scheduled tasks
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Download and execute messages, which are used to download and run secondary payloads as scheduled tasks
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Both TELESHIM and MIXEDKEY have been found to rely on heavy code obfuscation techniques, including string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to deter reverse engineering efforts.
The final payload is encrypted using two layers of XOR encryption... MIXEDKEY decrypts the payload and reflectively loads it.
TELESHIM also employs an array of methods to detect the presence of virtualization-based analysis environments. Some of these are listed below - Hypervisor detection using CPUID RAM speed check using the Windows Management Instrumentation (WMI)
Hypervisor detection using CPUID RAM speed check using the Windows Management Instrumentation (WMI)
When the host executable reaches that point in its startup, the trampoline fires and execution enters the implant's main payload. By redirecting execution via an installed hook, the code is executed in the context of the host executable to evade security tools.
Network reconnaissance ipconfig /all ipconfig /displaydns netstat -ano Discover information about the system's network configuration and active network connections.
System reconnaissance net user ... Discover information about current users
netstat -ano ... Discover information about the system’s network configuration and active network connections.
tasklist ... Discover information about current users, list of running processes, and the hostname of the infected machine.
hostname ... Discover information about current users, list of running processes, and the hostname of the infected machine.
File reconnaissance dir c:\Users dir c:\Users\ \desktop dir c:\Users\ \Downloads dir C:\ProgramData\Crypto\DSS\ dir C:\ProgramData\ dir C:\ProgramData\Lenovo dir C:\ProgramData\Intel
TELESHIM also employs an array of methods to detect the presence of virtualization-based analysis environments. Some of these are listed below - Hypervisor detection using CPUID RAM speed check using the Windows Management Instrumentation (WMI)
Hypervisor detection using CPUID RAM speed check using the Windows Management Instrumentation (WMI)
TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic
In the next phase, TELESHIM enters a polling loop by sending HTTP GET requests to the following URL to fetch updates: https://api.telegram.org/bot /getUpdates?offset=
TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.
Download and execute messages, which are used to download and run secondary payloads as scheduled tasks
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.