Targeted Attack on Government Entities in the Middle East | Part 1

Zscaler ThreatLabz observed a targeted, multi-stage intrusion (July 2026) against government entities in the Middle East that deployed undocumented malware implants TELESHIM (32-bit DLL backdoor using Telegram-based C2), MIXEDKEY (64-bit reflective loader with environment-keyed decryption), and BINDCLOAK (final 64-bit C2 implant). The report details initial delivery via a signed ASUSTek executable sideloading AsTaskSched.dll, heavy code obfuscation (CFF, MBA, opaque predicates), anti-analysis checks, persistence via scheduled tasks, environmental keying tied to the drive volume serial, captured post-compromise operator activity (reconnaissance, staging, deployment), and multiple IOCs (file hashes, filenames, C2 domain).