A newly uncovered cyberespionage campaign has turned Telegram bots into quiet controllers for backdoors planted inside Middle Eastern government networks. <\/p>\n
The operation relies on familiar Windows components and legitimate-looking files, allowing attackers to establish access without immediately drawing attention.<\/a><\/p>\n The infection begins with an ISO image carrying a real ASUSTek RegSchdTask.exe program and a harmful companion DLL. <\/p>\n When launched, the program loads the attacker\u2019s code, opening a multi-stage route that later delivers TELESHIM, MIXEDKEY, and the BINDCLOAK implant.<\/a><\/p>\n TELESHIM uses Telegram\u2019s Bot API as its command channel, making malicious traffic resemble ordinary communications with a trusted online service. <\/p>\n Researchers from Zscaler identified the activity in July 2026 while tracking an East Asia-linked actor targeting government entities in the Middle East.<\/a><\/p>\n Zscaler\u00a0said in a report<\/a> shared with\u00a0Cyber Security News (CSN)\u00a0that the operators captured reconnaissance results, deployed new payloads, and maintained access through scheduled tasks. <\/p>\n The activity shows why\u00a0Telegram bot C2 channels<\/a>\u00a0deserve close scrutiny when they appear on systems that have no clear business need for them.<\/a><\/a><\/p>\n The attackers used TELESHIM as the first backdoor in the chain. It contacts Telegram, checks for messages sent to a specific chat, and can run commands only when they are addressed to the infected machine\u2019s unique network identifier.<\/a><\/p>\n That design gives operators a low-profile way to manage compromised systems. Rather than connecting directly to a suspicious server, the malware polls a widely used service, collects instructions, executes them through Windows command tools, and returns the results in encrypted form.<\/a><\/p>\n TELESHIM also receives files through the bot interface, decrypts them locally, and launches them using scheduled tasks. <\/p>\n This combination of remote control and timed execution mirrors the persistence methods described in\u00a0scheduled task persistence attacks<\/a>, which can allow malware to return after a restart.<\/a><\/a><\/p>\n The backdoor attempts to frustrate investigation before it begins its main work. It checks for virtualized environments, examines memory characteristics, performs heavy disk activity, and hides text strings to slow down automated scanning and manual analysis.<\/a><\/p>\n After gaining a foothold, the operators performed system, user, network, and file discovery to understand each victim environment. <\/p>\n They then selected a staging location and deployed a legitimate executable with a malicious DLL, a tactic often called sideloading, to load the next component.<\/a><\/p>\n The second-stage loader, MIXEDKEY, decrypts an encrypted payload using the infected device\u2019s volume serial number as part of its key. <\/p>\n That means the final implant is designed to work only on the intended victim, making recovered files less useful to analysts elsewhere.<\/a><\/p>\n The last payload, BINDCLOAK, is a 64-bit implant that communicates with an attacker-controlled domain. <\/p>\n Zscaler assessed, with moderate-to-high confidence, that the operator is based in East Asia, but did not link the activity to a known threat group.<\/a><\/p>\n Defenders should review unexpected ISO files, abnormal DLL loading beside trusted programs, and newly created scheduled tasks. <\/p>\n Security teams should also investigate unusual Telegram API traffic from government workstations, especially where the messaging service is not required, while tracking broader\u00a0DLL sideloading malware activity<\/a>\u00a0for related warning signs.<\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/a><\/a><\/p>\nHackers Turn Telegram Bots Into Secret Backdoor<\/strong><\/h2>\n
Multi-Stage Intrusion Chain<\/strong><\/h2>\n
![\"Multi-stage](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhuCHy20NBLLNq2bSXR-YN3Na1PW54FQW9DkCJuxUKlFtkgD74T6flWiK3yzSZS_7OG6S_UfC0JzRZX1Ov-0HyoCaqWcvklr3fn7idS5m6Ljtag2kghIPhhtgv1lMY9662UazdDzvnFQA7I5hCPJqOi9vsneoHZMh0l7Dh1lQCu4WdaC8LXSbFlZwV_T3E\/s1600\/Multi-stage%2520attack%2520chain%2520%28Source%2520-%2520Zscaler%29.webp?ssl=1\")