TELESHIM Shows Why Telegram C2 Belongs in Government Intrusion Hunts, Bulwark Black

Zscaler reported a targeted Middle East government intrusion using TELESHIM, MIXEDKEY, BINDCLOAK, DLL side-loading, scheduled tasks, and Telegram API C2. Here is what defenders should hunt for.

Source: Zscaler ThreatLabz, “Targeted Attack on Government Entities in the Middle East | Part 1”.

Zscaler ThreatLabz reported a targeted July 2026 intrusion campaign against government entities in the Middle East that used a layered Windows malware chain tracked as TELESHIM, MIXEDKEY, and BINDCLOAK. The details matter because the campaign is not built around one flashy exploit. It is built around tradecraft defenders keep seeing in real incidents: DLL side-loading, legitimate binaries, scheduled tasks, encrypted strings, environmental keying, and command-and-control hidden inside legitimate internet services.

For small businesses, public-sector suppliers, and government contractors, the practical lesson is straightforward: modern intrusion detection cannot stop at “did the endpoint block the file?” The activity Zscaler describes is the kind of operation that can look like normal Windows administration until the sequence is stitched together.

What Zscaler Reported

The observed attack chain began with an ISO file containing a legitimate ASUS executable, RegSchdTask.exe, which side-loaded a malicious DLL named AsTaskSched.dll. That first-stage malware, TELESHIM, installed itself under C:\ProgramData\shimgen_Data\ and created a scheduled task named shimgen that ran every six minutes.

TELESHIM then used the Telegram API for command-and-control. According to Zscaler, the implant polled Telegram for operator messages, validated the chat ID, registered infected systems by MAC address, executed commands through cmd.exe /C, and could download and launch additional files. That gives defenders a useful behavioral pattern: Telegram access from workstations is not automatically malicious, but Telegram API polling from a newly staged binary under ProgramData should get attention fast.

The operator activity captured by Zscaler included host discovery, user and process enumeration, network reconnaissance, directory listing, scheduled-task creation, and network connectivity checks. The next-stage payloads were staged under paths such as C:\ProgramData\Crypto\DSS\, with names chosen to blend into Microsoft Platform Crypto Provider-related terminology. Zscaler tracks the reflective loader as MIXEDKEY and the final C2 implant as BINDCLOAK.

Why This Matters

The campaign shows how disciplined intrusions turn ordinary Windows features into durable access. Scheduled tasks provide persistence. Legitimate signed binaries provide cover. Telegram provides a resilient communications channel. ProgramData provides a low-friction staging location. Environmental keying makes payload analysis harder by tying decryption to victim-specific machine data.

None of those techniques are new by themselves. The risk comes from the combination. A security stack may tolerate a signed ASUS or GoPro executable. A network device may allow outbound HTTPS to Telegram. An administrator may ignore a directory that appears to reference crypto provider files. The attacker’s advantage is in making every individual step look just plausible enough.

Defensive Takeaways for SMBs and Government Contractors

Hunt for suspicious scheduled tasks. Review new tasks running from C:\ProgramData, especially those set to execute every few minutes and those using generic names like feedback, update, shim, service, or alert.
Monitor DLL side-loading paths. Alert when legitimate vendor executables load unexpected DLLs from writable directories rather than trusted installation paths.
Baseline Telegram usage. If Telegram is not approved in the environment, block or alert on api.telegram.org. If it is approved, look for scripted API polling behavior from non-browser processes.
Correlate ProgramData staging with process execution. Files created under ProgramData that quickly become scheduled-task targets are high-value hunting leads.
Watch for reconnaissance bursts. Commands like net user, tasklist, ipconfig /all, netstat -ano, and broad user-directory enumeration should be reviewed when they originate from unusual parent processes.
Preserve endpoint telemetry. This kind of investigation depends on process lineage, command-line history, file creation events, DLL load events, and DNS/HTTPS destination logs.

Bulwark Black Assessment

The most important signal in this report is not Telegram by itself. It is the attacker’s patience. The campaign used a staged chain, victim-specific payload protection, and operator-driven reconnaissance before deploying the final implant. That points to targeted espionage, not opportunistic commodity malware.

Organizations that support government customers should treat this as a reminder to harden the middle of the kill chain. You may not see the initial lure. You may not have a signature for BINDCLOAK yet. But you can still detect a strange scheduled task, a legitimate binary loading the wrong DLL, a ProgramData staging directory, or Telegram API traffic from a process that has no business talking to Telegram.

That is the defender’s window. Catch the quiet setup before the final implant becomes the only thing left to find.