%3Aquality(100)&w=640&q=75){kind=logo}
TELESHIM Abuses Telegram's Own API to Camouflage C2 Against Middle East Governments
STATUS: Ongoing Activity SEVERITY: 7/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Jul 30, 2026
·Blog
·Secure Communications
%3Aquality(100)&w=3840&q=75)
A three-stage malware chain was identified that routes command-and-control traffic through the Telegram API to blend in with ordinary network activity, alongside sandbox-evasion techniques built to detonate only against the intended government target.¹
What Happened — and Why It Is Different
A trusted consumer platform, weaponized as the command channel itself. A campaign against Middle East government entities has been linked with moderate-to-high confidence to an East Asia-based adversary, deploying three previously unreported malware families: TELESHIM, MIXEDKEY, and BINDCLOAK.¹ The distinguishing feature is TELESHIM's use of the Telegram API for command-and-control communication, chosen specifically to blend malicious traffic in with legitimate internet activity rather than to reach a bespoke, attacker-registered server.¹
The attack chain opens with an ISO file containing a legitimate executable ("RegSchdTask.exe") that sideloads a rogue DLL ("AsTaskSched.dll"), the TELESHIM backdoor.¹ TELESHIM then retrieves next-stage components over Telegram, two of which trigger a second DLL-sideloading chain ("GoProAlertService.exe" and "pthreadVC2.dll") that decrypts and executes a reflective loader codenamed MIXEDKEY.¹ The final payload is locked behind two layers of XOR encryption, the second using environmental keying derived from the infected machine's volume serial number, so the malware only fully detonates on the intended target.¹
Both TELESHIM and MIXEDKEY use heavy obfuscation, including string encryption, control-flow flattening, and mixed boolean arithmetic.¹ TELESHIM separately checks for hypervisor presence and abnormal RAM speed to detect sandboxed analysis environments before proceeding.¹ Observed post-compromise activity, dated July 7–9, 2026 and concentrated between 4 a.m. and 12 p.m. UTC, included system, user, and network reconnaissance and delivery of further payloads via BINDCLOAK, a C++ implant contacting an external server.¹ The campaign has not yet been tied to a known, named threat actor.¹
What Attackers Gained — And What They Can Do With It
Attacker Gain | What It Enables | Operational Consequence | Post-Compromise Risk |
Trusted-platform C2 channel via the Telegram API¹ | Route command-and-control traffic through Telegram's own, legitimate API rather than a bespoke attacker-controlled server.¹ | C2 traffic is indistinguishable from ordinary consumer messaging activity on a monitored government network. | Detection rules built around anomalous or unrecognized destinations miss this traffic by design, not by gap. |
DLL sideloading via signed executables, across two chains¹ | Execute a malicious payload under cover of a legitimate, trusted binary at two separate stages of the intrusion.¹ | Signature-based EDR and application allowlisting built around trusted executables don't flag the sideloaded DLL. | Each sideloading chain is reusable against other targets, swapping in a different legitimate host binary. |
Sandbox and analysis evasion, environmental keying¹ | Detonate the final payload only on the intended machine, using a decryption key derived from that machine's volume serial number.¹ | Security research and automated sandboxes see inert or partial behavior, delaying detection and public attribution. | The malware can sit dormant indefinitely in any environment that isn't the real target, including a monitored test system. |
Reconnaissance and staged payload delivery in a fixed operating window¹ | Run system, user, and network reconnaissance and deliver further payloads as scheduled tasks.¹ | Attacker builds a working map of the compromised government network during each observed session. | A consistent 4 a.m.–12 p.m. UTC operating window points to a standing operational rhythm, not a one-off intrusion. |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
Consumer messaging platforms are low-risk on a government network because they are not themselves the target. | TELESHIM uses the Telegram API as its C2 channel, turning a permitted consumer platform into cover for espionage traffic.¹ | BlackBerry® SecuSUITE® runs on a closed, purpose-built channel, not a public consumer API any malware author can also register and hide inside. |
Network monitoring built to flag anomalous destinations will catch command-and-control traffic. | Traffic to Telegram's own infrastructure is ordinary and expected on many networks, so this C2 channel blends in by design.¹ | BlackBerry® UEM® enforces which applications and network destinations are permitted on managed devices, closing off ungoverned messaging traffic as a blind spot. |
Sandbox testing and EDR reliably catch new malware before it reaches production government networks. | TELESHIM is purpose-built to detect virtualization and analysis environments and stay dormant until it confirms the real target.¹ | Continuous BlackBerry UEM compliance monitoring evaluates managed endpoints in their live state on an ongoing basis, narrowing the window evasion-aware malware depends on. |
Recommended Actions
IMMEDIATE | Audit outbound traffic on government-managed Windows devices for connections to Telegram API infrastructure not tied to an approved business use.¹ |
IMMEDIATE | Review endpoint logs for the specific artifacts named in Zscaler's write-up — RegSchdTask.exe, AsTaskSched.dll, GoProAlertService.exe, pthreadVC2.dll — across any fleet with Middle East government exposure.¹ |
SHORT-TERM | Extend application and network allowlisting policy to explicitly restrict consumer messaging API traffic from managed government endpoints not already standardized on BlackBerry SecuSUITE. |
SHORT-TERM | Enroll at-risk endpoints in BlackBerry UEM for continuous compliance monitoring rather than point-in-time scanning, given TELESHIM's sandbox-evasion design. |
ONGOING | Track attribution updates. ThreatLabz assesses East Asia origin with moderate-to-high confidence but has not tied the campaign to a known, named group.¹ |
BlackBerry Position
Threat actors increasingly abuse trusted public services to conceal malicious activity. The answer is not greater trust in the platform, but greater control over the communications environment through secure, managed, and purpose-built channels. A closed, purpose-built communications architecture has no equivalent public API surface for an attacker to hide inside.
Citations:
Targeted Attack on Government Entities in the Middle East | Part 1 (Zscaler ThreatLabz, Sudeep Singh, July 20, 2026).
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments (The Hacker News, July 27, 2026).
TELESHIM Abuses Telegram's Own API to Camouflage C2 Against Middle East Governments
STATUS: Ongoing Activity SEVERITY: 7/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Jul 30, 2026
·Blog
·Secure Communications
A three-stage malware chain was identified that routes command-and-control traffic through the Telegram API to blend in with ordinary network activity, alongside sandbox-evasion techniques built to detonate only against the intended government target.¹
What Happened — and Why It Is Different
A trusted consumer platform, weaponized as the command channel itself. A campaign against Middle East government entities has been linked with moderate-to-high confidence to an East Asia-based adversary, deploying three previously unreported malware families: TELESHIM, MIXEDKEY, and BINDCLOAK.¹ The distinguishing feature is TELESHIM's use of the Telegram API for command-and-control communication, chosen specifically to blend malicious traffic in with legitimate internet activity rather than to reach a bespoke, attacker-registered server.¹
The attack chain opens with an ISO file containing a legitimate executable ("RegSchdTask.exe") that sideloads a rogue DLL ("AsTaskSched.dll"), the TELESHIM backdoor.¹ TELESHIM then retrieves next-stage components over Telegram, two of which trigger a second DLL-sideloading chain ("GoProAlertService.exe" and "pthreadVC2.dll") that decrypts and executes a reflective loader codenamed MIXEDKEY.¹ The final payload is locked behind two layers of XOR encryption, the second using environmental keying derived from the infected machine's volume serial number, so the malware only fully detonates on the intended target.¹
Both TELESHIM and MIXEDKEY use heavy obfuscation, including string encryption, control-flow flattening, and mixed boolean arithmetic.¹ TELESHIM separately checks for hypervisor presence and abnormal RAM speed to detect sandboxed analysis environments before proceeding.¹ Observed post-compromise activity, dated July 7–9, 2026 and concentrated between 4 a.m. and 12 p.m. UTC, included system, user, and network reconnaissance and delivery of further payloads via BINDCLOAK, a C++ implant contacting an external server.¹ The campaign has not yet been tied to a known, named threat actor.¹
What Attackers Gained — And What They Can Do With It
Attacker Gain | What It Enables | Operational Consequence | Post-Compromise Risk |
Trusted-platform C2 channel via the Telegram API¹ | Route command-and-control traffic through Telegram's own, legitimate API rather than a bespoke attacker-controlled server.¹ | C2 traffic is indistinguishable from ordinary consumer messaging activity on a monitored government network. | Detection rules built around anomalous or unrecognized destinations miss this traffic by design, not by gap. |
DLL sideloading via signed executables, across two chains¹ | Execute a malicious payload under cover of a legitimate, trusted binary at two separate stages of the intrusion.¹ | Signature-based EDR and application allowlisting built around trusted executables don't flag the sideloaded DLL. | Each sideloading chain is reusable against other targets, swapping in a different legitimate host binary. |
Sandbox and analysis evasion, environmental keying¹ | Detonate the final payload only on the intended machine, using a decryption key derived from that machine's volume serial number.¹ | Security research and automated sandboxes see inert or partial behavior, delaying detection and public attribution. | The malware can sit dormant indefinitely in any environment that isn't the real target, including a monitored test system. |
Reconnaissance and staged payload delivery in a fixed operating window¹ | Run system, user, and network reconnaissance and deliver further payloads as scheduled tasks.¹ | Attacker builds a working map of the compromised government network during each observed session. | A consistent 4 a.m.–12 p.m. UTC operating window points to a standing operational rhythm, not a one-off intrusion. |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
Consumer messaging platforms are low-risk on a government network because they are not themselves the target. | TELESHIM uses the Telegram API as its C2 channel, turning a permitted consumer platform into cover for espionage traffic.¹ | BlackBerry® SecuSUITE® runs on a closed, purpose-built channel, not a public consumer API any malware author can also register and hide inside. |
Network monitoring built to flag anomalous destinations will catch command-and-control traffic. | Traffic to Telegram's own infrastructure is ordinary and expected on many networks, so this C2 channel blends in by design.¹ | BlackBerry® UEM® enforces which applications and network destinations are permitted on managed devices, closing off ungoverned messaging traffic as a blind spot. |
Sandbox testing and EDR reliably catch new malware before it reaches production government networks. | TELESHIM is purpose-built to detect virtualization and analysis environments and stay dormant until it confirms the real target.¹ | Continuous BlackBerry UEM compliance monitoring evaluates managed endpoints in their live state on an ongoing basis, narrowing the window evasion-aware malware depends on. |
Recommended Actions
IMMEDIATE | Audit outbound traffic on government-managed Windows devices for connections to Telegram API infrastructure not tied to an approved business use.¹ |
IMMEDIATE | Review endpoint logs for the specific artifacts named in Zscaler's write-up — RegSchdTask.exe, AsTaskSched.dll, GoProAlertService.exe, pthreadVC2.dll — across any fleet with Middle East government exposure.¹ |
SHORT-TERM | Extend application and network allowlisting policy to explicitly restrict consumer messaging API traffic from managed government endpoints not already standardized on BlackBerry SecuSUITE. |
SHORT-TERM | Enroll at-risk endpoints in BlackBerry UEM for continuous compliance monitoring rather than point-in-time scanning, given TELESHIM's sandbox-evasion design. |
ONGOING | Track attribution updates. ThreatLabz assesses East Asia origin with moderate-to-high confidence but has not tied the campaign to a known, named group.¹ |
BlackBerry Position
Threat actors increasingly abuse trusted public services to conceal malicious activity. The answer is not greater trust in the platform, but greater control over the communications environment through secure, managed, and purpose-built channels. A closed, purpose-built communications architecture has no equivalent public API surface for an attacker to hide inside.
Citations:
Targeted Attack on Government Entities in the Middle East | Part 1 (Zscaler ThreatLabz, Sudeep Singh, July 20, 2026).
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments (The Hacker News, July 27, 2026).
%3Aquality(100)&w=3840&q=75)