TELESHIM: East Asia APT Abuses Telegram for C2 to Backdoor Government Systems — How Trusted Apps Become Attack Channels

TITLE: TELESHIM: East Asia APT Abuses Telegram for C2 to Backdoor Government Systems — How Trusted Apps Become Attack Channels

SLUG: teleshim-apt-telegram-c2-government-backdoor

FOCUS_KEYWORD: TELESHIM Telegram C2 APT

META_DESC: East Asia APT deploys TELESHIM malware using Telegram Bot API for C2 to backdoor government systems. Technical breakdown, IOCs, and zero-trust defences.

CONTENT:

Attackers have found a way to route command-and-control traffic through one of your employees’ most-trusted messaging applications — and most enterprise firewalls are waving the traffic through without a second glance. On July 27, 2026, researchers at Zscaler ThreatLabz published the first detailed technical analysis of a sophisticated, targeted campaign against government entities across the Middle East — one that deploys three previously unknown malware families and routes all command-and-control (C2) traffic through the legitimate Telegram Bot API. The operation, anchored by a backdoor called TELESHIM, represents a methodical shift in how nation-state adversaries blend into enterprise traffic to remain invisible for weeks.

For security leaders in India and across South Asia — where government agencies, defence PSUs, critical infrastructure operators, and IT-services firms maintain deep operational ties to Gulf counterparts — this campaign is not merely a regional story. The tactics, techniques, and procedures (TTPs) are immediately exportable. If a three-stage malware chain hidden inside a trusted messaging app worked against a government ministry in the Gulf, it will work against a government department or enterprise in Delhi, Mumbai, or Bengaluru. The question is whether your SOC will see it before the damage is done.

What Is TELESHIM? The Three-Malware Toolkit Explained

TELESHIM is not a single tool — it is the first stage of a modular, multi-component intrusion kit designed for long-term, stealthy access. Zscaler ThreatLabz’s analysis reveals three distinct components, each handing off to the next in a carefully sequenced chain designed so that detecting one layer does not expose the others:

Component	Type	Primary Role	Key Technique
TELESHIM	32-bit Windows DLL backdoor	First-stage C2 and payload retrieval	Telegram Bot API polling over HTTPS
MIXEDKEY	64-bit reflective loader	Decrypt and reflectively load BINDCLOAK	Volume serial number environmental keying
BINDCLOAK	64-bit C++ C2 implant	Persistent command-and-control	Beacons to cert.hypersnet[.]com

Even if a security tool detects and quarantines TELESHIM, the encrypted BINDCLOAK blob may already be sitting on disk in a C:\ProgramData\ subdirectory, waiting for a different sideloading chain to invoke it. Defence at a single layer is insufficient — all three stages must be hunted simultaneously.

Technical Breakdown: The Attack Chain Step by Step

The infection begins with a weaponised ISO file. ISO containers became a preferred delivery vehicle after Microsoft disabled automatic macro execution in internet-sourced Office documents. This campaign exploits exactly that shift, delivering its payload in a format that many email gateways and endpoint tools still treat more permissively than Office documents.

Inside the ISO sits a completely legitimate ASUS binary — RegSchdTask.exe — alongside a malicious DLL named AsTaskSched.dll. When the victim runs the trusted ASUS executable, Windows’ DLL search-order resolution loads the rogue DLL from the same directory first, executing TELESHIM silently within the security context of a signed, trusted application. This is textbook DLL sideloading: no vulnerability required, no elevated privileges at launch, no code-signing to bypass.

Once active, TELESHIM executes a structured sequence:

1. Establishes persistence via a Windows scheduled task that runs every six minutes, surviving reboots.
2. Polls the Telegram Bot API (api.telegram.org/bot[TOKEN]/getUpdates) over HTTPS port 443, using the victim machine’s MAC address as a unique identifier.
3. Receives operator commands Base64-encoded and encrypted, executing them via cmd.exe /C.
4. Downloads next-stage payloads and drops them to C:\ProgramData\ directories.

In the second stage, a fresh DLL sideloading chain — this time using GoProAlertService.exe and pthreadVC2.dll — invokes MIXEDKEY. The reflective loader uses XOR decryption with the machine’s volume serial number as the key to unlock the BINDCLOAK payload. This environmental keying ensures the binary is inert and undecryptable anywhere except the specific victim machine for which it was prepared. BINDCLOAK then establishes persistent C2 communications, beaconing to cert.hypersnet[.]com — a hostname deliberately crafted to resemble certificate-infrastructure traffic.

TELESHIM also deploys sophisticated anti-analysis defences: control flow flattening (CFF) and mixed boolean arithmetic (MBA) obfuscation scramble the code’s structure to defeat static analysis tools; a CPUID hypervisor check terminates execution inside sandboxes; and WMI RAM speed queries detect the implausibly fast simulated hardware typical of automated malware-analysis environments. GBHackers has additional coverage of the C2 hiding mechanism.

The Telegram C2 Problem: Why Your Firewall Is Blind

The most strategically significant choice in this campaign is not the malware sophistication — it is the decision to use Telegram’s public Bot API as the primary C2 channel. This creates an asymmetric detection problem:

• Telegram is widely permitted. Millions of employees across government agencies, banks, hospitals, and private enterprises use Telegram for legitimate communication. Blocking it causes significant operational friction that most IT departments resist.
• The traffic is HTTPS on port 443. Without active TLS inspection, your next-gen firewall, CASB, or IDS sees only encrypted traffic flowing to known, trusted Telegram IP ranges — indistinguishable from a legitimate user checking messages.
• Volume provides camouflage. In environments where Telegram is in routine use, periodic GET requests to /getUpdates from a malicious process are buried in thousands of legitimate API calls every hour.

This is precisely the zero-trust failure mode that perimeter-centric network thinking cannot solve. A perimeter firewall asks: “Is Telegram allowed?” The answer is often yes. A zero-trust architecture asks a different question: “Should this specific process, at this privilege level, from this endpoint, be making outbound API calls to api.telegram.org?” That question surfaces TELESHIM immediately — because RegSchdTask.exe and GoProAlertService.exe have no legitimate reason to ever contact Telegram’s servers.

This campaign shares its foundational deception logic with another East Asia-linked operation covered on this blog: the UAT-7810 LONGLEASH ORB network, where attackers similarly hid malicious relay traffic inside infrastructure that appeared completely routine to traditional network monitoring. The common thread: abuse of trusted channels to defeat signature-based detection.

Attribution and Geopolitical Context

Zscaler ThreatLabz attributes this campaign to an East Asia-based threat actor with moderate-to-high confidence, citing three independent evidence pillars:

1. The public IP address of the C2 operator geolocates to East Asia.
2. The Windows server locale configured on attacker infrastructure is set to an East Asian language.
3. Observed C2 activity is concentrated between 7–11 AM UTC, aligning with structured working hours in East and Southeast Asian time zones (12:30 PM – 4:30 PM IST).

Importantly, the campaign has not been attributed to any previously tracked, named APT group. This suggests either an entirely new intrusion set or a known actor operating with significantly refreshed tooling and infrastructure. Either scenario underscores the continuing expansion of East Asia-linked cyber operations targeting government entities across the broader Indo-Pacific and Middle East — regions where Indian strategic, commercial, and diplomatic interests are deeply engaged. Indian IT service providers, outsourcing firms with Gulf public-sector clients, and government-linked organisations with regional partnerships should treat this intelligence as directly relevant.

The targeting of government entities, combined with the use of environmental keying and modular malware, is consistent with long-term intelligence collection operations rather than financially motivated cybercrime. This is not a ransomware group monetising access — it is an adversary building patient, persistent footholds for strategic intelligence gathering.

The use of AI-capable adversarial tools continues to evolve in parallel — as explored in our earlier analysis of JadePuffer, the autonomous AI ransomware. State APTs and criminal operators are converging on the same insight: the best way to evade detection is to hide inside legitimate, trusted systems.

What You Should Do Right Now — Sanjay Seth’s Expert Recommendations

For CISOs, IT heads, and security practitioners in India and across South Asia, this campaign delivers urgent, actionable defensive lessons. Here is a prioritised response list:

1. Audit Telegram access at the application layer. If Telegram is not a business-critical application, block api.telegram.org and Telegram’s IP ranges at your next-gen firewall or web proxy. Where Telegram is legitimately in use, implement TLS inspection combined with anomaly-based rules to flag non-human API polling patterns — particularly periodic automated GET requests to /getUpdates.
2. Deploy DLL sideloading detection in your EDR. Hunt for signed executables loading unsigned DLLs from the same directory — particularly when those executables run from removable media paths, %TEMP%, or C:\ProgramData\. FortiEDR, CrowdStrike Falcon, Microsoft Defender for Endpoint, and most mature EDR platforms have module-load telemetry that surfaces these patterns. Create specific detection rules for ASUS utilities loading unexpected DLLs.
3. Block ISO file delivery via email gateways. Ensure your Secure Email Gateway (SEG) strips or sandboxes ISO attachments. Many gateway configurations were updated for Office macro blocking but not for ISO-as-lure delivery — this is a simple, high-value fix that takes minutes to implement.
4. Hunt for environmental keying artifacts. MIXEDKEY reads the machine’s volume serial number. Query your SIEM or EDR for processes issuing unusual WMI queries for disk properties or RAM speed outside normal system inventory operations — this is a specific, low-noise hunt query.
5. Block the known IOCs immediately. Add cert.hypersnet[.]com to your DNS sinkhole and threat intelligence blocklists. Hash IOCs for TELESHIM (SHA-256: 5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d) and MIXEDKEY are available in full from Zscaler ThreatLabz’s technical report.
6. Enforce application allowlisting on high-value endpoints. Particularly for government-connected systems, executives, finance teams, and anyone with access to sensitive data, allowlisting prevents unsigned or unexpected DLLs from executing — even when sideloaded through a trusted signed binary.
7. Mandate live memory acquisition before reimaging any compromised host. Because BINDCLOAK is environmentally keyed, the decrypted implant exists only in memory on the victim machine. If your incident response team reimages the endpoint without capturing a memory snapshot first, the decrypted payload — and any forensic evidence it contains — is gone permanently.

As detailed in The Hacker News’s coverage of this campaign, the sophistication of the evasion layering — Telegram C2, environmental keying, anti-sandbox checks — marks this as a well-resourced, professionally operated intrusion set that will likely continue expanding its targeting.

Frequently Asked Questions

Is this TELESHIM campaign actively targeting Indian organisations?

Zscaler ThreatLabz’s published analysis identifies Middle Eastern government entities as the confirmed targets in this specific campaign. However, the TTPs are not geographically restricted — the same ISO-based delivery, DLL sideloading, and Telegram C2 chain can be adapted against organisations anywhere. Indian government agencies, defence-adjacent enterprises, IT services firms with Gulf public-sector clients, and financial institutions maintaining regional business relationships should treat this as directly actionable threat intelligence, not a distant regional concern.

Does patching my systems protect against TELESHIM?

No — this campaign does not exploit any known CVE. DLL sideloading abuses a legitimate Windows DLL search-order feature, not a vulnerability in the traditional sense. Keeping your operating system and third-party applications fully patched is always essential hygiene, but it will not prevent TELESHIM from executing. The effective defences here are behavioural: DLL load monitoring, application allowlisting, outbound TLS inspection, and network anomaly detection.

How does TELESHIM defeat sandbox analysis?

TELESHIM uses the CPUID instruction to detect hypervisors: if it detects it is running inside a virtual machine — the typical sandbox environment — it terminates immediately. It also issues WMI queries to validate RAM speed; sandboxes often simulate implausibly fast hardware, which TELESHIM treats as a termination signal. Combined with control flow flattening and mixed boolean arithmetic code obfuscation, static analysis tools also fail to parse its true execution logic. This multi-layer evasion explains why the campaign operated undetected for at least 22 days before discovery.

What is environmental keying and why does it matter for incident response?

Environmental keying means the BINDCLOAK payload is encrypted using a key derived from the target machine’s unique volume serial number. If a forensic analyst extracts the encrypted payload from disk and attempts to decrypt or execute it in a laboratory environment, decryption fails and the malware does nothing. This significantly complicates post-breach forensic analysis. It means incident responders must prioritise live memory acquisition from the compromised endpoint before any reimaging — the decrypted implant exists only in memory, never in the form that can be analysed elsewhere.

---