TELESHIM Malware Abuses Telegram C2 in Middle East Government Attacks

Cyber-Espionage Campaign Overview

Security researchers have uncovered a targeted cyber-espionage campaign directing fresh malware families at government entities across the Middle East. The activity involves an adversary with established ties to East Asia leveraging custom implant families—dubbed TELESHIM, MIXEDKEY, and BINDCLOAK—to maintain persistent access within compromised state networks.

Technical Analysis of TELESHIM and Telegram C2

The defining characteristic of the intrusion cycle is TELESHIM’s reliance on Telegram as its command-and-control (C2) channel. By routing traffic through official Telegram Bot APIs and infrastructure, the malware blends seamlessly into standard HTTPS web traffic, bypassing traditional perimeter defenses and domain-based blocklists.

Once executed on a victim machine, TELESHIM communicates with attacker-controlled Telegram bots to receive commands, exfiltrate stolen files, and stage secondary payloads. The accompanying payloads, MIXEDKEY and BINDCLOAK, serve specialized roles within the execution chain:

• MIXEDKEY: Handles payload decryption and memory injection, ensuring stealthy persistence while obscuring core malware components from host-based security controls.
• BINDCLOAK: Functions as an execution host and network binder, establishing local persistence mechanisms and facilitating lateral movement within target network segments.

Defense and Mitigation Guidance

Defending against abuse of legitimate web services like Telegram requires granular network monitoring beyond domain-level filtering:

• Inspect Encrypted Egress Traffic: Deploy SSL/TLS inspection on network perimeters to examine API endpoints. Restrict access to api.telegram.org from critical server segments and enterprise workstations where messaging applications are not explicitly authorized.
• Behavioral Endpoint Monitoring: Audit process execution trees for spawned command interpreters (cmd.exe, powershell.exe) or anomalous network connections originating from non-standard binary directories or temporary folders.
• Credential and Token Hygiene: Rotate service accounts and administrative credentials across targeted infrastructure to prevent lateral movement via compromised session tokens or cached credentials.