Full Report
Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.
Analysis Summary
# Threat Actor: Unnamed East Asian Adversary
## Attribution & Identity
* **Origin:** High-confidence assessment of East Asia.
* **Evidence:** Attribution is based on the threat actor's public IP addresses, system locales configured on their Windows C2 server, and active operational hours (4 a.m. – 12 p.m. UTC).
* **Aliases/Associations:** Currently not attributed to a known named group or APT; identified as a "fresh" threat cluster by Zscaler ThreatLabz.
## Activity Summary
* **Campaign Period:** Detected in early July 2026, with peak post-compromise activity observed between July 7 and July 9, 2026.
* **Operational Status:** Active.
* **Summary:** The actor is conducting highly targeted intrusions against Middle Eastern government entities using a sophisticated multi-stage attack chain involving DLL side-loading and unique, custom-built malware.
## Tactics, Techniques & Procedures
* **Initial Access:** Delivery of malicious ISO files containing legitimate executables.
* **Persistence & Execution:** Extensive use of DLL Side-Loading (T1574.002) using `RegSchdTask.exe` and `GoProAlertService.exe`.
* **Evasion:**
* **Code Obfuscation:** Employment of Control Flow Flattening (CFF), Mixed Boolean Arithmetic (MBA), opaque predicates, and string encryption.
* **Anti-Analysis:** Virtualization detection via CPUID hypervisor checks and RAM speed checks via WMI.
* **Environmental Keying (T1480.001):** Final payloads are XOR-encrypted using keys derived from the victim's volume serial number to prevent detonation in sandboxes or on unintended systems.
* **Command and Control:**
* **Protocol Abused:** Abuse of Telegram API for C2 to blend in with legitimate HTTPS traffic (T1102).
* **Fallback/Secondary C2:** Use of dedicated external servers for high-level implants.
* **Discovery:** Post-compromise system, user, and network reconnaissance.
## Targeting
* **Sectors:** Government entities.
* **Geography:** Middle East.
* **Victims:** Specific organizations were not named, but identified as government-affiliated.
## Tools & Infrastructure
* **TELESHIM:** A 32-bit Windows backdoor used for initial C2 via Telegram API; capable of exfiltrating data and downloading secondary payloads.
* **MIXEDKEY:** A reflective loader used to decrypt and execute subsequent stages in memory.
* **BINDCLOAK:** A 64-bit C++ C2 implant used for the final stage of the attack.
* **Infrastructure:**
* `cert.hypersnet[.]com` (C2 Server)
* Abuse of Telegram API for `TELESHIM` communications.
## Implications
The use of environmental keying and heavy obfuscation (MBA/CFF) indicates a high-tier adversary focused on stealth and long-term persistence. By targeting government entities in the Middle East, the actor likely aims for espionage, data exfiltration, or geopolitical intelligence gathering. The operational hours suggest a professional unit operating during standard business hours in an East Asian timezone.
## Mitigations
* **DLL Sideloading Defense:** Monitor and block known-vulnerable legitimate executables (like older versions of `RegSchdTask.exe`) when executed from unusual paths like `/Downloads` or temporary folders.
* **Telegram Monitoring:** Inspect or restrict outbound traffic to `api.telegram[.]org` from sensitive government servers if there is no legitimate business need.
* **Endpoint Security:** Deploy EDR solutions capable of detecting reflective loading and memory-resident malware, specifically focusing on behavior-based detection of CFF and MBA-obfuscated code.
* **ISO Handling:** Implement policies or technical controls to restrict the mounting of ISO files by standard users, as these are increasingly used to bypass Mark-of-the-Web (MotW) protections.