TELESHIM, MIXEDKEY, and the Rise of Telegram C2 in Government Attacks
Zscaler ThreatLabz just released a detailed report on a concerning campaign attributed to an East Asian threat actor targeting Middle Eastern government entities. They've uncovered a new malware ecosystem featuring three families: TELESHIM, MIXEDKEY, and BINDCLOAK.
The standout here is TELESHIM's use of Telegram as a Command-and-Control (C2) channel. It's a classic "living off the land" technique—abusing a widely trusted, whitelisted platform to fly under the radar of standard egress filtering. MIXEDKEY appears to handle the keylogging, while BINDCLOAK likely provides network cloaking capabilities.
Detecting this requires looking for anomalies in otherwise legitimate traffic. We usually hunt for processes accessing the Telegram API that shouldn't be. If you are using Sigma, you might want to update your rules to catch generic API calls from office suites.
For those doing DFIR, here is a quick Python snippet to scan a file dump for potential Telegram Bot API tokens, which are often hard-coded or injected in memory:
import re
def scan_for_telegram_tokens(data):
# Pattern for standard Bot API tokens
pattern = rb"[0-9]{8,10}:[A-Za-z0-9_-]{35}"
matches = re.findall(pattern, data)
return matches
# Usage: read binary file and pass bytes to the function
The question is: **How are you handling application whitelisting in high-security environments? Are you strictly blocking social media platforms, or relying on behavioral analysis to catch C2 traffic over allowed channels?**
We've seen a massive shift towards Discord and Telegram C2s in our red team exercises. Blocking these entirely is often a political nightmare in Gov sectors because 'official comms' use them. We've had luck using Zeek to inspect the telegram.org connections. If the User-Agent isn't the official desktop/mobile client, it gets blocked immediately.
Good catch on the regex. I'd add that you need to be careful with BINDCLOAK if it involves DNS tunneling. Standard regex won't catch that. We monitor for high-entropy DNS queries to non-corporate domains.
# Quick entropy check for suspicious subdomains
awk '{print $1}' dns_logs.txt | sort -u | ./entropy_tool.py | awk '$2 > 3.5'
If the entropy is high, it's often tunneling.
From a pentester perspective, these Telegram C2s are incredibly effective because they bypass most legacy firewalls. The detection logic needs to move to the endpoint. If you see a signed binary (like a legitimate office app) spawning a Python or PowerShell process that touches the internet, kill it immediately.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access