TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments TELESHIM 滥用 Telegram 作为中东政府攻击的 C2

TL;DR

• A new multi-stage cyber campaign targeting Middle Eastern governments uses three previously unknown malware families: TELESHIM, MIXEDKEY, and BINDCLOAK.
• The attackers abuse Telegram’s API for command-and-control (C2) communication to blend in with legitimate traffic, evading network detection.
• Heavy obfuscation techniques—including control flow flattening, mixed boolean arithmetic, string encryption, and environmental keying—are used to hinder reverse engineering and analysis.

Why It Matters

This attack highlights a growing trend of threat actors leveraging popular, trusted platforms like Telegram for C2 operations, making it harder for defenders to distinguish malicious traffic from normal user activity. The use of advanced obfuscation and environment-specific payload decryption underscores the increasing sophistication of state-aligned or nation-linked cyber operations, particularly those targeting government infrastructure in geopolitically sensitive regions.

Technical Details

• The initial infection vector involves an ISO file containing a legitimate executable (“RegSchdTask.exe”) that sideloads a rogue DLL (“AsTaskSched.dll”), which deploys TELESHIM—a 32-bit Windows backdoor.
• TELESHIM communicates via Telegram API using two message types: control messages (for host registration, command execution, and data exfiltration) and download/execute messages (to fetch and run secondary payloads as scheduled tasks).
• The second stage triggers a DLL side-loading chain involving “GoProAlertService.exe” and “pthreadVC2.dll,” where the latter acts as a reflective loader named MIXEDKEY to decrypt and execute a hidden payload stored in “C99F29AC08454855B3D538960BB2F34F.PCPKEY.”
• The final payload is protected by double XOR encryption, with the second layer using environmental keying—deriving the decryption key from the victim machine’s volume serial number—to ensure activation only on intended targets.
• BINDCLOAK, a 64-bit C2 implant written in C++, is deployed last and contacts an external server at “cert.hypersnet[.]com,” completing the attack chain.

Industry Insight

Security teams should prioritize monitoring for unusual Telegram API usage patterns, especially from systems not typically associated with such traffic, as this method effectively bypasses traditional firewall and IDS rules. Additionally, organizations must strengthen endpoint detection and response (EDR) capabilities against obfuscated binaries and reflective loading techniques, while also implementing strict controls around executable permissions and DLL sideloading behaviors to mitigate early-stage compromise vectors.

TL;DR

• 威胁行为体利用Telegram API作为命令与控制（C2）通道，伪装成合法流量以规避检测。
• 攻击链包含多阶段DLL侧加载技术，涉及TELESHIM、MIXEDKEY和BINDCLOAK三种新型恶意软件家族。
• 恶意代码采用高强度混淆技术（如控制流展平、混合布尔算术）及环境密钥加密，专门针对特定目标触发。
• 攻击活动集中在UTC时间4点至12点之间，且通过IP地理位置与系统本地化特征推断源自东亚地区。
• 该案例反映了当前APT攻击中融合信任平台滥用、EDR逃避与动态载荷执行的典型趋势。

为什么值得看

本文揭示了高级持续性威胁（APT）如何巧妙结合流行通信工具（Telegram）与Windows底层机制（DLL侧加载、反射加载）构建隐蔽攻击链，对网络安全从业者理解现代恶意软件传播路径与防御策略具有重要参考价值。同时，其使用的混淆与环境感知技术为研发更智能的威胁检测模型提供了真实场景依据。

技术解析

• 初始载体为ISO文件内含合法可执行文件RegSchdTask.exe，用于旁加载恶意DLL AsTaskSched.dll，进而植入32位后门TELESHIM。
• TELESHIM通过Telegram API发送两类指令：注册主机MAC地址并回传执行结果的控制消息，以及下载并调度执行第二阶段载荷的下载执行消息。
• 第二阶段触发GoProAlertService.exe与pthreadVC2.dll组成的DLL侧加载链，其中pthreadVC2.dll作为反射加载器MIXEDKEY解密并运行加密文件C99F29AC08454855B3D538960BB2F34F.PCPKEY。
• 最终载荷BINDCLOAK为64位C++编写的植入物，连接外部服务器cert.hypersnet[.]com，实现持久化控制与进一步侦察。
• 所有关键组件均使用字符串加密、控制流展平（CFF）、混合布尔算术（MBA）、不透明谓词等混淆手段防逆向分析，并通过CPUID指令、WMI查询RAM速度等方式检测虚拟化沙箱环境；最终载荷采用双层XOR加密，第二层基于卷序列号生成解密密钥实现环境绑定。

行业启示

• 组织应加强对第三方应用（如Telegram）在企业网络中的访问控制与流量审计，防止其被滥用作C2通道。
• 安全团队需提升对DLL侧加载、反射加载等内存驻留技术的监测能力，结合EDR日志与行为分析识别异常进程注入行为。
• 针对定向攻击，建议建立基于地理区域、操作时段与系统配置特征的威胁情报关联模型，提前预警潜在APT活动。