TELESHIM / MIXEDKEY / BINDCLOAK — DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks
The victims here are government entities in the Middle East, not Europe, and the actor is assessed as East-Asian — so the reason this matters to a Swiss or European government defender is the tradecraft, which is aimed at exactly their target class and combines three techniques that each defeat a different common control. Zscaler ThreatLabz "observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East", assessing attribution "with moderate-to-high confidence" on the basis of "the geolocation of the IP address, the configured system locale, and active operational hours matching regional working timeframes" (Zscaler ThreatLabz, 2026-07-20) — a hedge worth carrying as stated rather than hardening into a country attribution.
Initial execution comes from an ISO containing a legitimate ASUSTek executable, RegSchdTask.exe, which side-loads a malicious library named AsTaskSched.dll; at the staging step the legitimate executable is copied to its working path under the name shimgen.exe (Zscaler ThreatLabz, 2026-07-20). The first code to run therefore executes under a legitimate vendor binary rather than an attacker-authored one, so controls that key on the executable's identity or reputation see a known-good file. The first-stage TELESHIM backdoor persists through scheduled tasks and, rather than contacting dedicated infrastructure, "abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic" — which means the egress destination is a mainstream service that many organisations either allow outright or cannot block without business friction, and domain- or reputation-based egress control gives no signal. TELESHIM and the MIXEDKEY reflective loader carry heavy obfuscation (control-flow flattening, mixed boolean arithmetic, opaque predicates), and the final BINDCLOAK implant is decrypted only with a key derived from the victim machine's volume serial number, so the payload cannot be detonated on any machine other than the intended one.
Triage: the ASUSTek executable is a legitimate vendor file, and DLL side-loading of this kind produces process telemetry that looks legitimate — so the discriminators are location and provenance rather than the executable's identity. Look for that vendor executable running from a mounted-image path or a user-writable directory instead of its installed application tree, loading a same-directory DLL, on a host with no corresponding ASUS software installed; a scheduled task created shortly afterwards under that lineage raises it further. For the C2 leg, traffic to the Telegram Bot API from a server or from a workstation whose user has no Telegram client installed is the reviewable case — Telegram traffic from staff endpoints that legitimately run the app is noise, and the discriminator is the absence of the client, or a non-browser, non-Telegram process making the connection.
ThreatLabz observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East.
TELESHIM abuses the Telegram API for C2 communication, a technique used to blend in with legitimate internet traffic.
Based on the geolocation of the IP address, the configured system locale, and active operational hours matching regional working timeframes, ThreatLabz assesses with moderate-to-high confidence that the threat actor is operating out of East Asia.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Persistence TA0003
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
Privilege Escalation TA0004
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1480.001Execution Guardrails: Environmental Keying
Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Command and Control TA0011
T1102.002Web Service: Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.