TELESHIM Malware Campaign: Telegram C2 Targets Governments

## Executive Summary: The TELESHIM Malware Campaign is a newly discovered, multi-stage espionage operation targeting government entities in the Middle East that leverages Telegram's API for stealthy command-and-control, employs DLL sideloading and environmental keying to limit execution to intended hosts, and deploys additional modules (MIXEDKEY, BINDCLOAK) for persistence, reconnaissance, and data exfiltration; Zscaler ThreatLabz provides technical analysis, IoCs, and TTPs and links the activity with moderate-to-high confidence to an East Asia–associated actor, though no formal APT attribution has been made.