Middle East Government Networks Hit by Multi-Stage Malware Using Telegram C2

Government entities in the Middle East were targeted in a July 2026 intrusion campaign that researchers linked with moderate-to-high confidence to an East Asia-based threat actor. The attack chain began with ISO or IMG lure files containing a legitimate ASUSTek executable, RegSchdTask.exe, which sideloaded a malicious DLL, AsTaskSched.dll, to deploy a newly documented backdoor called TELESHIM. Researchers said TELESHIM used heavy obfuscation, anti-analysis checks, and scheduled-task persistence, while abusing the Telegram API for command-and-control to blend malicious traffic with legitimate services.

The operation then used a reflective loader named MIXEDKEY to decrypt and launch the final BINDCLOAK implant, with decryption tied to the victim machine through environmental keying based on the volume serial number. Investigators also observed hands-on-keyboard activity after compromise, including reconnaissance, persistence creation, connectivity checks, and staged delivery of follow-on payloads, with command activity concentrated between 4 AM and 12 PM UTC. The campaign has not been attributed to a known APT group, but the malware set and tradecraft indicate a targeted espionage operation against regional government networks.