Malware News Zscaler ThreatLabz has published Part 2 of their technical analysis of a targeted campaign against government entities in the Middle East.

[Khushal]

Content source

https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-2

Part 1 covered a multi-stage infection chain that begins with an ISO file delivering previously undocumented tooling: TELESHIM and MIXEDKEY. In Part 2, they analyze BINDCLOAK and highlight code overlaps and shared C2 infrastructure with OctLurk.
After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting. Building upon our initial findings, Part 2 dives into a detailed technical analysis of BINDCLOAK, a new modular stage 3 backdoor uncovered during our investigation. As detailed later in our threat attribution section, key code similarities between BINDCLOAK and OctLurk as well as shared command-and-control (C2) infrastructure directly connect the threat actor behind OctLurk to the campaign we describe in this two-part blog series.

ThreatLabz assesses with high-confidence that BINDCLOAK is a variant of OctLurk. In this blog, we analyze BINDCLOAK’s previously undocumented C2 communication channel.

Targeted Attack on Middle East Govts (Part 2) | ThreatLabz

ThreatLabz examines a targeted attack against Middle East governments using a multi-stage attack chain with new tooling that we named BINDCLOAK.

www.zscaler.com

Key Takeaways​

• BINDCLOAK is a previously undocumented and new 64-bit modular Windows backdoor written in C++ that was deployed on victims' machines during post-compromise activity.
• BINDCLOAK is decrypted and reflectively loaded by MIXEDKEY in a multi-stage attack chain targeting government entities in the Middle East.
• A complex message routing mechanism is used by BINDCLOAK to manage the C2 communication channel with the C2 server.
• BINDCLOAK implements endpoint detection and response (EDR) evasion techniques to prevent detection of API calls from unbacked executable memory regions.

 

[Bot]

Notable defensive implications

This report is significant because the infection chain combines several techniques that can complicate endpoint investigation:

• An ISO serves as the initial delivery container, which can obscure the relationship between the lure and the later payloads.
• MIXEDKEY reflectively loads the encrypted BINDCLOAK stage, reducing the need for a conventional executable written to disk.
• BINDCLOAK’s modular design and message-routing mechanism may allow the operator to change functionality without replacing the entire backdoor.
• EDR evasion focused on API calls from unbacked executable memory can make memory telemetry and behavioral detection especially important.

Organizations exposed to this type of activity should prioritize blocking or tightly controlling ISO files from untrusted sources, monitor processes that mount disk images and launch unusual child processes, and investigate suspicious executable memory allocations followed by network activity. Memory acquisition and analysis may be necessary when the disk does not contain a complete payload.

The reported code similarities and shared C2 infrastructure support ThreatLabz’s assessment, but infrastructure and code overlap should still be interpreted alongside victimology, deployment details, and other evidence. Detection guidance should be based on the indicators and behaviors in the original report rather than relying only on the malware name or attribution.

The main takeaway is that file-based scanning alone may miss this chain; prevention of untrusted disk-image execution, behavioral monitoring, and endpoint memory visibility are important defensive controls.