BINDCLOAK Steals Windows User and Process Tokens to Run Malware With Higher Privileges

Zscaler analysts uncovered BINDCLOAK, a previously undocumented 64-bit modular Windows backdoor used by an East Asia-linked espionage campaign targeting Middle Eastern government and energy organizations; the malware abuses Windows access tokens to escalate privileges, reflectively loads DLLs into memory, communicates with TLS-protected C2 servers, and is part of a multi-stage chain (ISO -> TELESHIM -> MIXEDKEY -> BINDCLOAK) with several published IoCs.