Cybersecurity researchers at **Zscaler ThreatLabz** have uncovered a new wave of malicious activity attributed to an East Asian threat actor. The campaign, detected earlier this month, focuses on government organizations within the Middle East. ### Novel Malware Families Emerge The intrusions have led to the deployment of three previously unreported malware families: **TELESHIM**, **MIXEDKEY**, and **BINDCLOAK**. These tools represent a significant evolution in the threat actor's capabilities. **Sudeep Singh**, Senior Manager of APT Research at **Zscaler ThreatLabz**, highlighted the sophisticated nature of the attack. "The campaign used a multi-stage attack chain to establish and maintain access on infected systems, with **TELESHIM** abusing the **Telegram** API for command-and-control (C2) communication to blend in with legitimate internet traffic," Singh detailed in a technical write-up.  ### The Multi-Stage Attack Chain The attack initiates with an ISO file containing a legitimate executable, `RegSchdTask.exe`. This executable is then leveraged to sideload a malicious DLL, `AsTaskSched.dll`, which functions as the 32-bit Windows backdoor, **TELESHIM**. **TELESHIM**'s primary function is to utilize the **Telegram** API for C2, allowing it to retrieve subsequent attack components. Two of these payloads trigger a second DLL side-loading sequence involving `GoProAlertService.exe` and `pthreadVC2.dll`. The latter acts as a reflective loader, codenamed **MIXEDKEY**, to decrypt and execute the contents of `C99F29AC08454855B3D538960BB2F34F.PCPKEY`. ### Evasion and Obfuscation Techniques Both **TELESHIM** and **MIXEDKEY** incorporate advanced code obfuscation techniques to hinder reverse engineering. These include string encryption, control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates. Furthermore, **TELESHIM** employs a range of methods to detect and evade virtualization-based analysis environments, such as: * Hypervisor detection using CPUID * RAM speed checks via Windows Management Instrumentation (WMI)  ### TELESHIM's C2 Capabilities **TELESHIM**'s C2 communications support two primary message types: * **Control messages**: Used to register the infected host by sending its MAC address, execute received commands, and exfiltrate results back to the server in chunks (if output exceeds 1,000 bytes). * **Download and execute messages**: Used to download and run secondary payloads as scheduled tasks. Notably, the final payload is protected by two layers of XOR encryption. The second layer employs **environmental keying**, where the decryption key is derived from the infected machine's volume serial number. This ensures the malware only detonates on its intended targets, preventing accidental execution in non-target environments. ### The Final Payload: BINDCLOAK The attack sequence culminates with the deployment of **BINDCLOAK**, a 64-bit C2 implant written in C++. This implant establishes communication with an external server at `cert.hypersnet[.]com`. **ThreatLabz** observed post-compromise activity from the C2 operator, including system, user, and network reconnaissance commands, as well as the delivery of additional payloads. This activity primarily occurred between July 7 and July 9, 2026, with C2 commands executed during specific hours (4 a.m. to 12 p.m. UTC, with a peak between 7 a.m. and 11 a.m. UTC). ### Attribution and Broader Trends Based on the threat actor's public IP address, Windows server locale, IP geolocation, and active operational hours, researchers assess with moderate-to-high confidence that the campaign originates from East Asia. While specific attribution to a known threat actor or group is not yet made, the tactics align with broader trends in sophisticated cyberattacks. "The activity also reflects broader trends such as EDR evasion, blending in with legitimate internet traffic through abuse of trusted platforms, and the use of code-obfuscation techniques such as MBA and CFF to hinder reverse engineering," Singh concluded. This highlights a persistent challenge for defenders in identifying and mitigating advanced persistent threats.