ctipilot.ch

TELESHIM

malware · malware:teleshim single-source

First-stage Windows backdoor in a three-stage espionage toolkit Zscaler ThreatLabz documented against government entities in the Middle East, attributed with moderate-to-high confidence to an actor operating out of East Asia on the basis of IP geolocation, system locale and operational hours. Delivered by an ISO carrying a legitimate ASUSTek executable (RegSchdTask.exe, staged as shimgen.exe) that side-loads a malicious AsTaskSched.dll, so first execution runs under a trusted vendor binary. Persists through scheduled tasks and abuses the Telegram Bot API for command-and-control so its egress resolves to a mainstream service; carries control-flow flattening, mixed boolean arithmetic and opaque predicates (Zscaler ThreatLabz, 2026-07-20).

Coverage timeline
2
first 2026-07-26 → last 2026-07-26
Peak priority
notable
2 notable
Sources cited
6
5 hosts
Sections touched
2
research, weekly-research
Co-occurring entities
2
see Related entities below
ATT&CK techniques
11
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1102.002 ×2T1027T1053.005T1055.012T1071.001T1071.004T1090T1480.001T1486T1574.001T1685
Tags
espionage ×2cloudidentitynation-stateransomware

ATT&CK techniques

11 techniques observed across 2 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

T1055.012Process Injection: Process Hollowing×1

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

T1055.012Process Injection: Process Hollowing×1

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1480.001Execution Guardrails: Environmental Keying×1

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1071.004Application Layer Protocol: DNS×1

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1090Proxy×1

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

T1102.002Web Service: Bidirectional Communication×2

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-07-26/weekly-w30-c2-through-trusted-infrastructure · ATT&CK page ↗

Story timeline

  1. 2026-07-26This week's tradecraft converged on hiding command-and-control inside trusted services and native tooling — Graph-API calendars, DNS, the Telegram API, a browser the malware never connects through, and BitLocker instead of a ransomware binary
    weekly-researchUnrelated W30 disclosures share one move — routing C2 and impact through trusted services and native tooling, so process/domain-based detection stays blind
  2. 2026-07-26TELESHIM / MIXEDKEY / BINDCLOAK — DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks
    researchAn espionage toolkit that only decrypts its final implant on the target machine, and talks C2 through the Telegram Bot API

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

related to

Where this entity is cited

  • research1
  • weekly-research1

Source distribution

  • securelist.com2 (33%)
  • blog.talosintelligence.com1 (17%)
  • group-ib.com1 (17%)
  • proofpoint.com1 (17%)
  • zscaler.com1 (17%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (6)

Entries about TELESHIM (2)

2026-07-26 · view entry permalink →

NOTABLENATOA1

This week's tradecraft converged on hiding command-and-control inside trusted services and native tooling — Graph-API calendars, DNS, the Telegram API, a browser the malware never connects through, and BitLocker instead of a ransomware binary

Six unrelated pieces of 2026-W30 research, read together, describe one defensive problem more usefully than any single sample: attackers are increasingly routing both command-and-control and impact through infrastructure and tooling defenders already trust, so detection that keys on process reputation or destination novelty is blind to it. This extends the prior weekly's state-nexus "blinding the defender's own visibility" theme from EDR-evasion into a broader pattern — the trusted carrier is the point.

On the C2 side, the convergence is striking. Group-IB's HOLLOWGRAPH never contacts attacker infrastructure directly: it plants and reads tasking as attachments on far-future Microsoft 365 calendar events via the Graph API, and Kaspersky independently corroborated the same Cavern framework, adding a resilience layer in which — when Microsoft Graph authentication or tenant validation fails — the module recovers replacement connection settings (TenantId, ClientId, ClientSecret, UserEmail) via DNS AAAA responses from attacker nameservers (Kaspersky, 2026-07-21). Cisco Talos's msaRAT goes further and removes the socket from the malware entirely — "This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API" (Cisco Talos, 2026-07-23), driving a headless browser to tunnel over a WebRTC DataChannel relayed via a Twilio TURN server (with Cloudflare Workers handling the signalling), so endpoint tooling that asks "which process opened the connection" sees only the browser. Zscaler's TELESHIM, used against Middle-East government targets, "abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic" (Zscaler ThreatLabz, 2026-07-20).

The same "use what is trusted" logic runs through the endpoint and impact layers. Proofpoint's Cruciferra crypter-as-a-service — used by the China-nexus actor TA4922 to deliver AsyncRAT — combines a process-ghosting loader with BYOVD EDR termination and indirect syscalls issued from a clean on-disk copy of ntdll.dll, defeating user-mode hooks that monitor the loaded copy (Proofpoint, 2026-07-20). And Kaspersky's "XEntry" extortion cases skipped a bespoke ransomware family entirely, entering via internet-exposed RDP and a misconfigured SQL Server and then using legitimate RMM tooling and a Group Policy Object to deploy native BitLocker for encryption-for-impact (Kaspersky, 2026-07-21) — an impact stage with no malware artifact to signature at all.

This RAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API.

Cisco Talos 2026-07-23

TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.

Zscaler ThreatLabz 2026-07-20

Builds on: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · 2026-07-22/cavern-cav3rn-oilrig-attribution-dns-aaaa-c2-fallback · 2026-07-24/msarat-chaos-cdp-webrtc-covert-c2 · 2026-07-26/teleshim-bindcloak-volume-serial-keying-government-espionage · 2026-07-21/cruciferra-crypter-as-a-service-process-ghosting-byovd · 2026-07-22/xentry-team-bitlocker-lotl-extortion-rmm-gpo

research26 Jul 23:43Zmulti-sourceOpen finding ↗
Sources: Group-IB Threat Intelligence · Kaspersky (Securelist / GReAT) · Cisco Talos · Zscaler ThreatLabz · Proofpoint Threat Insight · Kaspersky (Securelist / GERT)

2026-07-26 · view entry permalink →

NOTABLENATOB2

TELESHIM / MIXEDKEY / BINDCLOAK — DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks

The victims here are government entities in the Middle East, not Europe, and the actor is assessed as East-Asian — so the reason this matters to a Swiss or European government defender is the tradecraft, which is aimed at exactly their target class and combines three techniques that each defeat a different common control. Zscaler ThreatLabz "observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East", assessing attribution "with moderate-to-high confidence" on the basis of "the geolocation of the IP address, the configured system locale, and active operational hours matching regional working timeframes" (Zscaler ThreatLabz, 2026-07-20) — a hedge worth carrying as stated rather than hardening into a country attribution.

Initial execution comes from an ISO containing a legitimate ASUSTek executable, RegSchdTask.exe, which side-loads a malicious library named AsTaskSched.dll; at the staging step the legitimate executable is copied to its working path under the name shimgen.exe (Zscaler ThreatLabz, 2026-07-20). The first code to run therefore executes under a legitimate vendor binary rather than an attacker-authored one, so controls that key on the executable's identity or reputation see a known-good file. The first-stage TELESHIM backdoor persists through scheduled tasks and, rather than contacting dedicated infrastructure, "abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic" — which means the egress destination is a mainstream service that many organisations either allow outright or cannot block without business friction, and domain- or reputation-based egress control gives no signal. TELESHIM and the MIXEDKEY reflective loader carry heavy obfuscation (control-flow flattening, mixed boolean arithmetic, opaque predicates), and the final BINDCLOAK implant is decrypted only with a key derived from the victim machine's volume serial number, so the payload cannot be detonated on any machine other than the intended one.

Triage: the ASUSTek executable is a legitimate vendor file, and DLL side-loading of this kind produces process telemetry that looks legitimate — so the discriminators are location and provenance rather than the executable's identity. Look for that vendor executable running from a mounted-image path or a user-writable directory instead of its installed application tree, loading a same-directory DLL, on a host with no corresponding ASUS software installed; a scheduled task created shortly afterwards under that lineage raises it further. For the C2 leg, traffic to the Telegram Bot API from a server or from a workstation whose user has no Telegram client installed is the reviewable case — Telegram traffic from staff endpoints that legitimately run the app is noise, and the discriminator is the absence of the client, or a non-browser, non-Telegram process making the connection.

ThreatLabz observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East.

TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.

Based on the geolocation of the IP address, the configured system locale, and active operational hours matching regional working timeframes, ThreatLabz assesses with moderate-to-high confidence that the threat actor is operating out of East Asia.

Zscaler ThreatLabz 2026-07-20
research26 Jul 14:15Zsingle-sourceOpen finding ↗
Sources: Zscaler ThreatLabz