Loading story…
Government entities in the Middle East were targeted in a July 2026 intrusion campaign that researchers linked with moderate-to-high confidence to an East Asia-based threat actor. The attack chain began with ISO or IMG lure files containing a legitimate ASUSTek executable, RegSchdTask.exe, which sideloaded a malicious DLL, AsTaskSched.dll, to deploy a newly documented backdoor called TELESHIM. Researchers said TELESHIM used heavy obfuscation, anti-analysis checks, and scheduled-task persistence, while abusing the Telegram API for command-and-control to blend malicious traffic with legitimate services.
The operation then used a reflective loader named MIXEDKEY to decrypt and launch the final BINDCLOAK implant, with decryption tied to the victim machine through environmental keying based on the volume serial number. Investigators also observed hands-on-keyboard activity after compromise, including reconnaissance, persistence creation, connectivity checks, and staged delivery of follow-on payloads, with command activity concentrated between 4 AM and 12 PM UTC. The campaign has not been attributed to a known APT group, but the malware set and tradecraft indicate a targeted espionage operation against regional government networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Gurucul published additional technical details for the Middle East government espionage campaign, including indicators of compromise such as the domain cert.hypersnet.com, multiple file hashes, and detection queries for defenders. The report also described Telegram API-based command-and-control communications used by the malware.
On 2026-07-20, Zscaler ThreatLabz published research describing the July 2026 campaign, its malware chain, and its assessment that the activity was linked to an East Asia-based threat actor. The report stated the activity was not yet attributed to a known APT group.
Researchers observed operators conducting reconnaissance, creating persistence, performing connectivity checks, and deploying next-stage payloads on compromised systems. Command timing was concentrated between 4 AM and 12 PM UTC.
The campaign used a multi-stage infection chain starting with ISO/IMG lures containing a legitimate ASUSTek executable, RegSchdTask.exe, which sideloaded a malicious DLL, AsTaskSched.dll. This chain deployed the TELESHIM backdoor, then the MIXEDKEY reflective loader, and finally the BINDCLOAK implant.
In July 2026, a targeted campaign hit government entities in the Middle East. Zscaler ThreatLabz assessed with moderate-to-high confidence that the operation was conducted by a threat actor operating from East Asia, but did not attribute it to a known APT group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecommunity.gurucul.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected Chinese-speaking threat actor has run a cyber-espionage campaign against government and public-sector organizations in Central Asia since at least January 2025, using the newly identified **OctLurk** and **SilkLurk** malware families to maintain persistent access and steal sensitive data. Kaspersky reported victims in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, and said the modular, largely memory-resident toolset was paired with **LurkProxy** to support reconnaissance, credential theft, lateral movement, remote access, keylogging, and staged exfiltration with tools such as **WinRAR** and **7-Zip**. Investigators also observed use of **secretsdump.py**, **Fscan**, **Pandora RC**, **PlugX**, and browser credential theft, while noting infrastructure overlaps with the earlier SilentRaid campaign without making a firm attribution. Zscaler ThreatLabz said the same activity expanded into the Middle East in July 2026, targeting government entities and the energy sector with **BINDCLOAK**, a previously undocumented 64-bit Windows backdoor assessed with high confidence to be a variant of **OctLurk**. Delivered by the **MIXEDKEY** loader, BINDCLOAK uses TLS over TCP, zlib compression, and dual rolling-XOR message protection, while supporting token theft and impersonation, reflective plugin loading, process discovery, and EDR evasion through indirect import resolution with `RtlQueueWorkItem` and `LoadLibraryW`. Researchers linked the operations through shared command-and-control infrastructure and certificate reuse, including domains such as `cert.hypersnet[.]com`, `about.blsouqs[.]com`, and `ssl.blsouqs[.]com`.
Aug 3, 2026
Escalating conflict following **Operation Epic Fury** (US/Israel strikes inside Iran) has coincided with increased cyber activity targeting Middle East and adjacent interests. Proofpoint reported that Iran-aligned **TA453** (*Charming Kitten / Mint Sandstorm / APT42*) continued intelligence collection during the conflict, including a **credential-phishing** attempt against a US think tank observed on **8 March**, and noted additional campaigns against Middle East government organizations with suspected links to multiple state or state-aligned actors (including suspected attribution to **China, Belarus, Pakistan, and Hamas**). Despite reported Iranian internet shutdown measures after the initial strikes, espionage-focused operations were assessed as ongoing. Check Point Research separately identified China-linked activity targeting **Qatar**, using conflict-themed lures (e.g., fake “war news”/damage imagery) to deliver malware, including **PlugX** and **Cobalt Strike**, with tradecraft described as a multi-stage chain involving a compromised server and **DLL hijacking** via a legitimate application (*Baidu NetDisk*) to load the backdoor—highlighting rapid weaponization of breaking news to target **energy** and **military** sectors. Other items in the set were not part of this conflict-driven espionage theme: one report described a Russian-speaking **‘BlackSanta’** BYOVD-based “EDR killer” delivered via HR workflow abuse and steganographic images, and a weekly threat bulletin summarized unrelated breaches and research (e.g., AkzoNobel, LexisNexis, Wikimedia worm, TriZetto, and AI-related threats).
Jun 29, 2026
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026