TELESHIM & BINDCLOAK: Defending Against Telegram C2 Attacks in Government Sectors

Introduction

Security operations centers (SOCs) supporting government entities in the Middle East must immediately heighten defensive postures following the discovery of a sophisticated cyber campaign orchestrated by an East Asian-linked threat actor. According to intelligence released by Zscaler ThreatLabz in July 2026, this campaign marks the debut of three previously undocumented malware families: TELESHIM, MIXEDKEY, and BINDCLOAK.

What makes this campaign particularly dangerous is its abuse of the Telegram API for Command and Control (C2) infrastructure. By leveraging a widely accepted social media platform, the attackers effectively bypass traditional network egress filtering, blending malicious traffic with legitimate user activity. For defenders, this represents a significant evolution in tradecraft that demands a shift from signature-based blocking to behavioral anomaly detection.

Technical Analysis

The attack chain involves the deployment of distinct malware modules designed to establish persistence, evade detection, and exfiltrate data. The core of this operation is TELESHIM, a malicious shim or implant specifically engineered to interface with Telegram's Bot API.

Malware Families

TELESHIM: This component acts as the primary C2 implant. Rather than connecting to a hardcoded IP address—which would be easily blockable—TELESHIM authenticates to Telegram using a bot token. It fetches commands and exfiltrates data via HTTPS to api.telegram.org. This method complicates network detection because the TLS handshake is valid, and the SNI (Server Name Indication) matches a legitimate domain.
MIXEDKEY: As the name suggests, this module is likely a keylogger or credential harvester. It hooks into keyboard inputs or clipboard data to capture sensitive authentication material, which is then funneled back through the TELESHIM C2 channel.
BINDCLOAK: This module appears to be an evasion tool, potentially used for DNS tunneling or cloaking malicious network traffic within seemingly benign DNS queries. It may also be used to hide the presence of the other malware families by manipulating system network configurations or binding malicious payloads to legitimate system processes.

Attack Chain and Exploitation Status

Targeting: Government entities in the Middle East.
Vector: While the initial infection vector (e.g., phishing, exploit) was not fully disclosed in the source, the post-exploitation activity is confirmed active.
C2 Mechanism: The abuse of Telegram provides the threat actor with a "living-off-the-land" (LotL) communication channel that is resilient to takedowns and difficult to distinguish from normal employee traffic without deep packet inspection (DPI) or endpoint telemetry.

Detection & Response

Detecting this threat requires a multi-layered approach. We must identify processes interacting with Telegram endpoints that are not the official Telegram client, and monitor for the persistence mechanisms likely employed by MIXEDKEY and BINDCLOAK.

SIGMA Rules

The following Sigma rules detect suspicious process interactions with Telegram APIs and potential DNS cloaking activities.

YAML

---
title: TELESHIM C2 Traffic via Telegram API
id: 8a2b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
description: Detects non-standard processes communicating with Telegram API endpoints, potential TELESHIM C2 activity.
references:
 - https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   DestinationHostname|contains:
     - 'api.telegram.org'
     - 'web.telegram.org'
 filter_legitimate_clients:
   Image|endswith:
     - '\Telegram.exe'
     - '\chrome.exe'
     - '\firefox.exe'
     - '\msedge.exe'
     - '\opera.exe'
 condition: selection and not filter_legitimate_clients
falsepositives:
 - Custom scripts that legitimately use Telegram Bot API
 - Users utilizing portable Telegram versions
level: high
---
title: Potential BINDCLOAK DNS Anomaly
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious high-volume DNS queries often associated with DNS tunneling or cloaking tools like BINDCLOAK.
references:
 - https://thehackernews.com/2026/07/teleshim-abuses-telegram-for-c2-in.html
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.command_and_control
 - attack.t1071.004
logsource:
 category: dns
 product: windows
detection:
 selection:
   QueryTypeName: 'TXT'
   QueryLength|gt: 10
 condition: selection | count() by SourceIp > 50
timeframe: 1m
falsepositives:
 - Security scanners
 - Misconfigured DNS clients
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt query looks for processes establishing connections to Telegram infrastructure from non-standard paths.

KQL — Microsoft Sentinel / Defender

DeviceNetworkEvents
| where RemoteUrl has "telegram.org"
| where InitiatingProcessFileName !in~ ("Telegram.exe", "chrome.exe", "msedge.exe", "firefox.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by Timestamp desc

Velociraptor VQL

Use this artifact to hunt for active network connections to Telegram endpoints or the presence of suspicious MIXEDKEY/BINDCLOAK file artifacts.

VQL — Velociraptor

-- Hunt for processes connecting to Telegram C2 infrastructure
SELECT Pid, Process.Name, Process.CommandLine, Conn.RemoteAddress, Conn.RemotePort
FROM pslist()
LEFT JOIN foreach(row=Process.Pids, query={
    SELECT RemoteAddress, RemotePort
    FROM netstat(pid=Process.Pid)
}) AS Conn
WHERE Conn.RemoteAddress =~ '149.154.167' OR Conn.RemoteAddress =~ '91.108.56'
   OR Process.Name =~ 'Telegram' AND Process.Exe NOT =~ '.*\\Program Files.*'

Remediation Script (PowerShell)

This PowerShell script assists in identifying active processes communicating with Telegram IPs and optionally blocks the IPs at the host firewall for immediate containment.

PowerShell

<#
.SYNOPSIS
    Incident Response Script for TELESHIM / BINDCLOAK Detection
.DESCRIPTION
    Identifies processes with connections to Telegram infrastructure and blocks Telegram API IPs at the host firewall.
#>

# Telegram IP Ranges (Current known ranges for api.telegram.org)
$TelegramIPs = @(
    "149.154.167.0/24",
    "91.108.56.0/24",
    "91.108.4.0/24"
)

Write-Host "[+] Checking for active connections to Telegram infrastructure..."

$Connections = Get-NetTCPConnection -State Established | 
    Where-Object { 
        ($TelegramIPs | ForEach-Object { $ip = $_; $_ -split '/' | Select-Object -First 1 }) -contains $_.RemoteAddress 
    }

if ($Connections) {
    foreach ($conn in $Connections) {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] Suspicious Connection Found:" -ForegroundColor Yellow
        Write-Host "    PID: $($conn.OwningProcess)"
        Write-Host "    Process Name: $($process.ProcessName)"
        Write-Host "    Remote Address: $($conn.RemoteAddress)"
        Write-Host "    Path: $($process.Path)"
    }
} else {
    Write-Host "[-] No active connections to Telegram IPs detected."
}

# Host-based Firewall Block (Emergency Containment)
$BlockChoice = Read-Host "Do you want to block Telegram API ranges at the host firewall? (y/n)"
if ($BlockChoice -eq 'y') {
    Write-Host "[+] Applying firewall rules..."
    foreach ($CIDR in $TelegramIPs) {
        New-NetFirewallRule -DisplayName "Block TELESHIM C2 $CIDR" -Direction Outbound -Action Block -RemoteAddress $CIDR | Out-Null
    }
    Write-Host "[+] Firewall rules applied successfully."
}

Remediation

Network Segmentation and Egress Filtering: While blocking Telegram entirely may not be feasible for all government agencies, strictly limit its usage to specific whitelisted subnets or user groups. Implement Proxy Server categorization rules to inspect TLS traffic to telegram.org where possible.
Endpoint Detection and Response (EDR): Ensure EDR sensors are configured to alert on "Non-Browser Process accessing Web Services" or specifically on connections to high-risk social media domains from office automation tools (e.g., PowerShell, MS Word, Excel).
User Awareness: Given the likely initial vector involves social engineering or phishing, immediate security awareness briefings should be conducted regarding the risks of downloading files from unexpected sources, even those purporting to be legitimate communications.
Hunt for Persistence: Review scheduled tasks and registry run keys for unusual entries that may correlate with the MIXEDKEY or BINDCLOAK persistence mechanisms.
Official Advisory: Monitor the Zscaler ThreatLabz feed for specific IOCs (hashes, bot tokens) associated with TELESHIM and integrate them into your threat intelligence platforms.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub