⚠️ Region Alert: UAE/Middle East
Cybersecurity researchers have identified a new campaign by an East Asian threat actor targeting government entities in the Middle East. The multi-stage attack utilizes previously undocumented malware families named TELESHIM, MIXEDKEY, and BINDCLOAK. TELESHIM is a 32-bit Windows backdoor that leverages the Telegram API for command-and-control communications, allowing it to blend in with legitimate network traffic while fetching secondary payloads.
The infection process employs advanced evasion techniques such as DLL side-loading and heavy code obfuscation, including control flow flattening and mixed boolean arithmetic. Notably, the final payload uses environmental keying—encrypting data with a key derived from the victim's volume serial number—to ensure the malware only executes on specific targets. The campaign concludes with the deployment of BINDCLOAK, a 64-bit implant used for system reconnaissance and further payload delivery.
Top comments (0)