Full research report
TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Executive assessment
The TELESHIM campaign is a technically sophisticated, narrowly targeted operation against Middle East government entities by an unattributed East Asia-based actor. Its most notable characteristics are the abuse of Telegram's legitimate Bot API for C2 (making network-layer detection difficult), the use of environmental keying to prevent detonation outside intended victims (frustrating sandbox analysis), and heavy code obfuscation across TELESHIM and MIXEDKEY that raises the cost of reverse engineering substantially. CVE-2026-50522 is a concurrent but independent SharePoint threat that the source material metadata incorrectly associated with this campaign; neither the Zscaler report nor any corroborating source links the two. Both threats require immediate defensive response but from different angles: TELESHIM demands endpoint and egress controls, while CVE-2026-50522 demands urgent patching of on-premises SharePoint. A follow-up Zscaler publication covering BINDCLOAK is expected and may reveal additional actor capability.
What happened
In early July 2026, Zscaler ThreatLabz identified a targeted intrusion campaign against government entities in the Middle East attributed with moderate-to-high confidence to an East Asia-based threat actor. The campaign deployed three previously undocumented malware families — TELESHIM, MIXEDKEY, and BINDCLOAK — through a multi-stage DLL sideloading chain delivered via trojanised ISO files. Confirmed post-compromise activity, including reconnaissance and secondary payload delivery, occurred between 7 and 9 July 2026. No known APT group has been attributed at the time of publication.
Affected scope
Middle East government entities. On the host side: Windows systems targeted via ISO-delivered DLL sideloading. CVE-2026-50522, listed in source metadata, is a separately confirmed critical vulnerability affecting on-premises Microsoft SharePoint Server Subscription Edition (before 16.0.19725.20434), SharePoint Server 2019 (before 16.0.10417.20175), and SharePoint Server 2016 (before 16.0.5561.1001); it has no established connection to this campaign.
Technical assessment
Initial access begins with an ISO image carrying a legitimate ASUSTek-signed binary (RegSchdTask.exe) used to sideload the malicious AsTaskSched.dll, which is the TELESHIM first-stage backdoor. TELESHIM polls the Telegram Bot API using spoofed browser User-Agent strings, allowing C2 traffic to blend with legitimate HTTPS flows. Anti-analysis measures include CPUID-based hypervisor detection and WMI RAM-speed checks. A second DLL sideloading chain (GoProAlertService.exe / pthreadVC2.dll) loads MIXEDKEY, a reflective loader that decrypts the final payload through two XOR layers, with the second key derived from the victim machine's volume serial number — ensuring execution only on intended targets. BINDCLOAK, the final 64-bit C++ implant, beacons to cert.hypersnet[.]com. Obfuscation across TELESHIM and MIXEDKEY uses control flow flattening, mixed boolean arithmetic, and opaque predicates to hinder static and dynamic analysis.
Recommended defensive actions
- Block or alert on outbound connections to api.telegram.org from endpoints that have no legitimate business requirement for direct Telegram API access.
- Hunt for ISO file execution patterns combined with DLL sideloading from signed third-party binaries (e.g. ASUSTek utilities), particularly in government environments.
- Apply the July 2026 SharePoint Server cumulative updates to remediate CVE-2026-50522 on all on-premises deployments; rotate IIS machine keys afterwards to invalidate any forged tokens.
- Monitor for scheduled task creation from DLL-loaded processes as TELESHIM uses scheduled tasks to persist secondary payloads.
- Scan for the IOC cert.hypersnet[.]com in DNS and proxy logs.
Uncertainties and evidence gaps
- The initial delivery mechanism (how targets were induced to mount the ISO) is not described in the published Zscaler report; a Part 2 publication is anticipated.
- CVE-2026-50522 is listed in source metadata as related to this story, but the primary Zscaler report contains no mention of SharePoint exploitation; the association appears to be an artefact of co-publication on the same news platform rather than a confirmed operational link.
- The specific government organisations targeted have not been publicly disclosed.
- Attribution is assessed with only moderate-to-high confidence based on IP geolocation, system locale, and operational hours; clock-based attribution can be manipulated.
- BINDCLOAK analysis was deferred to a follow-up publication; its full capability set is unknown.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
TELESHIM campaign exploits no CVEs; initial access relies solely on DLL sideloading via a trojanised ISO. CVE-2026-50522 (SharePoint Server deserialization, CVSS 9.8) appears in source metadata but has no confirmed link to this campaign; it is a separately confirmed exploited vulnerability added to CISA KEV on 22 July 2026.
The investigation began by separating the TELESHIM campaign from the co-featured CVE-2026-50522 SharePoint story, which source metadata had conflated. Fetching the Zscaler ThreatLabz primary report and its Security Boulevard mirror confirmed that TELESHIM uses ISO-based DLL sideloading with no CVE exploitation whatsoever. Parallel searches and page fetches verified CVE-2026-50522 independently as a critical but unrelated SharePoint deserialization flaw patched in July 2026 and added to CISA KEV on 22 July. The conclusion is high-confidence for the TELESHIM campaign's technique and scope, with the CVE correlation correctly assessed as an artefact of co-publication rather than an operational link.
- What are the key facts in the primary reporting on TELESHIM?Fetched the Hacker News article cited in source material.thehackernews.com ↗
Three-malware campaign (TELESHIM, MIXEDKEY, BINDCLOAK) targeting Middle East governments via ISO/DLL sideloading; Telegram API C2; activity 7–9 July 2026; no CVEs mentioned.
why Established the event baseline and confirmed no SharePoint link in the article body; CVE-2026-50522 appeared only in the sidebar as a separate headline.
- What does the originating vendor research say in detail?Fetched the Zscaler ThreatLabz primary blog post.zscaler.com ↗
Full attack chain confirmed: ISO → sideload → TELESHIM → MIXEDKEY → BINDCLOAK. No CVEs. IOCs: cert.hypersnet[.]com, specific MD5/SHA256 hashes. Attribution: East Asia, moderate-to-high confidence.
why Primary technical source; explicitly states 'no CVEs exploited', ruling out the SharePoint connection and validating DLL sideloading as sole access technique.
- Is CVE-2026-50522 confirmed as used in this campaign or is it a separate story?Searched for TELESHIM combined with CVE-2026-50522 and fetched the Security Boulevard mirror of the Zscaler report.securityboulevard.com ↗
No mention of CVE-2026-50522 or SharePoint in the Zscaler report. The search returned no results connecting the two stories operationally.
why Corroborated the absence of any SharePoint exploitation; the CVE's presence in source metadata is an artefact of co-publication, not an operational link.
- What is the authoritative record for CVE-2026-50522?Fetched the NVD detail page for CVE-2026-50522.nvd.nist.gov ↗
CVSS 9.8, CWE-502 deserialization RCE, unauthenticated network vector; affects SharePoint 2016/2019/SE; published 14 July 2026; CISA KEV deadline 25 July 2026.
why Authoritative confirmation of the CVE's scope and severity, supporting its importance as a separate defensive priority even without a TELESHIM connection.
- What is the exploitation timeline and impact of CVE-2026-50522?Fetched the Security Affairs article on CVE-2026-50522 exploitation.securityaffairs.com ↗
Public PoC released 20 July 2026; active exploitation began within hours; attackers extract IIS machine keys enabling persistent forged-token access; added to CISA KEV 22 July 2026.
why Confirms rapid weaponisation of the PoC, justifying its retention as a high-priority defensive action despite having no confirmed link to TELESHIM.
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1653 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok2 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7058 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5307 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok665 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories1
Authoritative record: CVSS 9.8, CWE-502, unauthenticated RCE via deserialization in SharePoint Server 2016/2019/SE; patched 14 July 2026.
Analysis & research4
Primary technical report; full attack chain, malware analysis, IOCs, and attribution reasoning for TELESHIM campaign.
Syndicated mirror of the Zscaler report; confirms ISO/DLL sideloading initial access and absence of any CVE exploitation.
Secondary reporting; corroborates Zscaler findings and provides context on broader East Asia APT trends.
Details the SharePoint CVE separately; confirms no link to TELESHIM; exploitation timeline verified here.