Malware News Zscaler ThreatLabz has published a technical analysis of a targeted campaign against Middle East government entities.

[Khushal]

Content source

https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1

Introduction​

In July 2026, Zscaler ThreatLabz observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East. During analysis, ThreatLabz captured post-compromise activity and uncovered previously undocumented malware tooling, including TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign used a multi-stage attack chain to establish and maintain access on infected systems, with TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic.

Targeted Attack on Middle East Govts (Part 1) | ThreatLabz

ThreatLabz examines a targeted attack against Middle East governments using a multi-stage attack chain with new tooling that we named TELESHIM and MIXEDKEY.

www.zscaler.com

This blog post (Part 1) explores the technical details of the multi-stage attack chain, focusing on TELESHIM, MIXEDKEY, and the post-compromise activity observed during the campaign. A follow-up post (Part 2) will provide a detailed technical analysis of the BINDCLOAK C2 implant.

Key Takeaways​

• In July 2026, ThreatLabz observed activity by a threat actor linked to East Asia targeting government entities in the Middle East.
• ThreatLabz identified full post-compromise activity leading to the discovery of previously undocumented malware tooling.
• The campaign used a multi-stage attack chain to deploy TELESHIM, MIXEDKEY, and BINDCLOAK on infected systems.
• TELESHIM and MIXEDKEY used heavy code obfuscation techniques leveraging control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates to hinder reverse engineering. TELESHIM also used various techniques to detect the presence of virtualization-based analysis environments.
• The threat actor leveraged environmental keying by encrypting BINDCLOAK using a decryption key derived from the infected machine’s volume serial number. This helps ensure the payload decrypts and executes only on intended targets.
• TELESHIM abused the Telegram API for C2 communication to blend in with legitimate internet traffic.

 

[Bot]

Security significance

Based on the supplied excerpt, the campaign relies on several defense-evasion techniques:

• A multi-stage payload chain involving TELESHIM, MIXEDKEY, and BINDCLOAK.
• Telegram API traffic used for command-and-control, which may blend with normal encrypted web activity.
• Control-flow flattening, mixed Boolean arithmetic, and opaque predicates to complicate analysis.
• Virtualization and analysis-environment detection.
• Environmental keying, with the BINDCLOAK decryption key derived from the system volume serial number.

These techniques can make static detection and sandbox analysis more difficult. Defenders should monitor suspicious Telegram API usage from servers or workstations, investigate unusual parent-child process chains, and collect endpoint telemetry before remediation where possible.

The excerpt alone does not provide enough information to determine whether a particular file, domain, or system is affected. The linked Zscaler report and any associated indicators of compromise should be checked against official security telemetry and reputable scanning services.