TELESHIM, MIXEDKEY, BINDCLOAK: Targeted Middle East Government Attack — OTX Pulse Analysis

In July 2026, AlienVault OTX detected a sophisticated, multi-stage malware campaign specifically targeting government entities in the Middle East. The campaign, attributed to a threat actor with links to East Asia, utilizes a previously undocumented malware toolkit consisting of TELESHIM, MIXEDKEY, and BINDCLOAK.

The attack chain demonstrates a high degree of operational security, employing DLL sideloading for initial execution and environmental keying to ensure the malware only runs within specific target environments. The primary objective appears to be long-term espionage and data exfiltration, facilitated by TELESHIM's abuse of the Telegram API for Command-and-Control (C2) communications, allowing the actor to blend in with legitimate network traffic.

Threat Actor / Malware Profile

Malware Families

• TELESHIM: A backdoor specifically designed to abuse the Telegram API for C2 traffic. This allows the attacker to bypass traditional network firewall rules that whitelist popular messaging apps. It employs heavy code obfuscation and environmental keying to evade sandbox analysis.
• MIXEDKEY: Likely a keylogging or credential harvesting component given the naming convention and targeting profile. It is used to capture sensitive authentication data from compromised government systems.
• BINDCLOAK: A covert utility used to hide malicious network bindings or processes, likely functioning as a loader or injection mechanism to establish persistence without triggering endpoint detection alerts.

Tactics, Techniques, and Procedures (TTPs)

• Initial Access: The campaign relies on DLL sideloading, where a legitimate, signed application is tricked into loading a malicious DLL from the same directory.
• Persistence: Achieved via the sideloading mechanism and potentially registry run keys associated with the BINDCLOAK component.
• Defense Evasion:
  • Code Obfuscation: Heavy obfuscation used throughout the payload to hinder static analysis.
  • Environmental Keying: Malware checks for specific system artifacts (e.g., specific domain joined status, language packs, keyboard layouts) before decrypting its payload and executing.
• Command and Control: Uses Telegram API endpoints (api.telegram.org) for beaconing and data exfiltration, making traffic detection difficult without deep packet inspection.

IOC Analysis

The provided Pulse contains 9 FileHash-MD5 indicators. No IPs or domains are explicitly listed in the snippet, but the operational use of Telegram implies reliance on api.telegram.org or Telegram core IP ranges.

Operational Guidance:

• EDR Correlation: Upload the provided MD5 hashes to your EDR solution to identify any files currently residing or executing on endpoints. Note that modern attackers often recompile binaries daily; these hashes are likely "first-stage" drop files.
• Network Hunting: Since no specific C2 domains are provided beyond the implied Telegram infrastructure, security teams should hunt for unsigned binaries or scripts initiating connections to Telegram endpoints from non-standard user paths.
• Tooling: Use VirusTotal or Hybrid Analysis for deep behavioral analysis of the hashes. Use Splunk or Microsoft Sentinel to hunt for the file execution events.

Hash List (MD5): 087499849115eb28c4364581d2b28d09 28b47bdf16d7af6f8ec21218eac9145a 3f60d53a2b5737d77e058d9e33cbe9eb 68926e6c958562deaae35de3d9f59de3 78a4f8574830bf7fbaf63d7da09be2b8 7a14a99d70d42d3f7bf72f843185fc07 7cbc51ada1a4aec88660ec32c408114b 97124a93766be732e8fef5a56a5346a2

Detection Engineering

Sigma Rules

---
title: Potential TELESHIM Telegram C2 Activity
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects processes connecting to Telegram API endpoints that are not the official Telegram client, potentially indicating TELESHIM C2 activity.
author: Security Arsenal
date: 2026/07/21
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: 'api.telegram.org'
    Initiated: 'true'
  filter_legit:
    Image|contains:
      - '\Telegram\'
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate 3rd party tools using Telegram API
level: high
tags:
  - c2
  - telegram
  - teleshim
---
title: Suspicious DLL Sideloading Execution
id: b1c2d3e4-f5a6-b7c8-d9e0-f1a2b3c4d5e6
status: experimental
description: Detects potential DLL sideloading where a system binary loads a DLL from a user-writable directory.
author: Security Arsenal
date: 2026/07/21
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|contains:
      - '\System32\'
      - '\SysWOW64\'
    ImageLoaded|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Desktop\'
  filter_signed:
    Signed: 'true'
    SignatureStatus: 'Valid'
  condition: selection and not filter_signed
falsepositives:
  - Legitimate software with poor architecture
level: medium
tags:
  - defense_evasion
  - privilege_escalation
  - dll_sideload
---
title: TELESHIM Environmental Keying Check via Registry
id: c2d3e4f5-a6b7-c8d9-e0f1-a2b3c4d5e6f7
status: experimental
description: Detects registry modifications often associated with environmental keying checks (e.g., Keyboard Layout or System ID changes) used by TELESHIM/MIXEDKEY.
author: Security Arsenal
date: 2026/07/21
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Keyboard Layouts\'
      - '\System\CurrentControlSet\Control\ComputerName\'
  condition: selection
falsepositives:
  - IT administrative changes
level: low
tags:
  - persistence
  - teleshim

KQL (Microsoft Sentinel)

// Hunt for known IOCs (File Hashes) on devices
DeviceFileEvents
| where MD5 in ("087499849115eb28c4364581d2b28d09", "28b47bdf16d7af6f8ec21218eac9145a", "3f60d53a2b5737d77e058d9e33cbe9eb", "68926e6c958562deaae35de3d9f59de3", "78a4f8574830bf7fbaf63d7da09be2b8", "7a14a99d70d42d3f7bf72f843185fc07", "7cbc51ada1a4aec88660ec32c408114b", "97124a93766be732e8fef5a56a5346a2")
| project Timestamp, DeviceName, FileName, FolderPath, SHA1, SHA256, MD5, InitiatingProcessAccountName
| extend AlertMessage = "TELESHIM/MIXEDKEY IOC Found"

PowerShell Hunt Script

<#
.SYNOPSIS
    Hunt script for TELESHIM/MIXEDKEY File Hashes.
.DESCRIPTION
    Scans fixed drives for the specific MD5 hashes associated with the July 2026 Pulse.
#>

$TargetHashes = @(    "087499849115eb28c4364581d2b28d09",
    "28b47bdf16d7af6f8ec21218eac9145a",
    "3f60d53a2b5737d77e058d9e33cbe9eb",
    "68926e6c958562deaae35de3d9f59de3",
    "78a4f8574830bf7fbaf63d7da09be2b8",
    "7a14a99d70d42d3f7bf72f843185fc07",
    "7cbc51ada1a4aec88660ec32c408114b",
    "97124a93766be732e8fef5a56a5346a2"
)

Write-Host "Starting scan for TELESHIM/MIXEDKEY indicators..."

$Drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -gt 0 }

foreach ($Drive in $Drives) {
    Write-Host "Scanning drive $($Drive.Root)..."
    try {
        Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($Hash -in $TargetHashes) {
                Write-Warning "[!] MALICIOUS FILE DETECTED: $($_.FullName) | MD5: $Hash"
            }
        }
    }
    catch {
        Write-Host "Error accessing drive $($Drive.Root): $_"
    }
}
Write-Host "Scan complete."

Response Priorities

• Immediate:
  • Block execution of the provided MD5 hashes across all endpoints via EDR isolation policies.
  • Hunt for any non-standard processes communicating with api.telegram.org and suspend related network sessions.
• 24 Hours:
  • Conduct credential resets for privileged accounts that may have been active on endpoints where MIXEDKEY (keylogger) activity is suspected.
  • Analyze historical logs for the DLL sideloading pattern to determine the scope of the initial infection.
• 1 Week:
  • Implement application allowlisting to prevent unsigned binaries from loading in sensitive directories.
  • Review and restrict internet access for servers and workstations that do not require business use of messaging platforms like Telegram.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub