# Telegram Is the New C2 Server: How an East Asian APT Hid Inside Your Chat App to Hit Middle Eastern Governments
Someone inside a Middle Eastern government ministry opened an ISO file sometime before July 7th. Within days, an attacker sitting in East Asia — working banker's hours, 7 to 11 AM UTC — was running reconnaissance commands through one of the world's most popular messaging apps, and nobody's network monitoring flagged it.
That's the short version. The longer version, published last week by Zscaler ThreatLabz, is a case study in how sophisticated threat actors have stopped trying to hide their C2 infrastructure and started hiding it inside ours.
## The Architecture of Invisibility
The campaign deploys three previously undocumented malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. Each plays a specific role in a layered intrusion chain designed to look, at nearly every stage, like normal traffic from legitimate software.
The initial vector is an ISO file — a delivery format that still catches organizations off guard despite years of abuse, because ISOs bypass Mark-of-the-Web protections on Windows and arrive looking like disk images. Inside sits RegSchdTask.exe, a genuine executable used to sideload a rogue DLL: AsTaskSched.dll, which is TELESHIM itself. The naming convention — legitimate-sounding Windows utilities, scheduler references — isn't accidental. These names are meant to survive a casual glance at a process list.
TELESHIM's defining feature is its C2 channel: the Telegram Bot API. Once installed, it registers the infected host by sending the machine's MAC address to an attacker-controlled Telegram bot, then sits and waits for instructions. Commands come back as Telegram messages. Results — including command output larger than 1,000 bytes — get chunked and exfiltrated the same way.
This is the core evasion logic. Organizations that monitor outbound traffic for known malicious domains or unusual protocols will see nothing but HTTPS to api.telegram.org. Blocking that domain would break every corporate Telegram client on the network, which is precisely why attackers keep reaching for this technique.
## Sideloading All the Way Down
After TELESHIM establishes persistence and C2, it pulls down the next stage: a second DLL sideloading chain involving GoProAlertService.exe — yes, the camera software — and pthreadVC2.dll, which acts as a reflective loader called MIXEDKEY. This decrypts and executes a payload stored with a long MD5-looking filename on disk.
Both TELESHIM and MIXEDKEY are built to resist analysis. The obfuscation stack is comprehensive: string encryption, control flow flattening, mixed boolean arithmetic, and opaque predicates. These aren't consumer-grade tricks — they're the same techniques you see in commercial packers and nation-state tooling. Control flow flattening in particular turns readable disassembly into a state machine nightmare; mixed boolean arithmetic makes constant folding and symbolic analysis computationally expensive. Analysts with automated tooling still need significant manual effort to work through this.
The VM detection is equally disciplined. TELESHIM checks CPUID for hypervisor presence and queries RAM speed through WMI — a subtler check than looking for VMware registry keys. Sandbox detonation won't give you clean execution.
## The Environmental Key: This Malware Only Runs on You
The final payload — BINDCLOAK, a 64-bit C++ implant — is locked behind two layers of XOR encryption. The second layer uses environmental keying: the decryption key is derived from the infected machine's volume serial number. Submit the sample to a sandbox and it won't detonate, because the sandbox's volume serial number doesn't match the target's.
This is a significant operational security choice. It means the attacker either had prior access to identify the specific targets before deploying the final payload, or accepted that BINDCLOAK would only activate on the correct machines — protecting the implant from analysis even if it's captured in transit or pulled from a compromised host in the wrong environment.
BINDCLOAK then reaches out to cert.hypersnet[.]com for its own C2 channel, fully separate from the Telegram infrastructure. By that point, TELESHIM has done its job: established a foothold, validated the environment, and pulled down the real tool.
## Reading the Clock
Zscaler observed active C2 commands exclusively between 4 AM and 12 PM UTC, with the heaviest concentration between 7 and 11 AM. That operational window, combined with the system locale on the attacker's Windows server and geolocation of the command IP, points Zscaler toward East Asia with moderate-to-high confidence.
This matters beyond attribution. Working operational hours against Middle Eastern government targets — where the business day runs roughly 6 AM to 3 PM UTC depending on the country — means the attacker is deliberately timing activity to overlap with their victims' working hours. Anomalous network traffic during business hours looks less anomalous. The operational security is deliberate.
The campaign is currently unattributed to any known threat group. Given the technical sophistication and geopolitical targeting pattern, that designation is likely temporary.
---
## HackWire Analysis
The Telegram-as-C2 technique isn't new, but this campaign reflects how mature the playbook has become. Three years ago, Telegram C2 was an emerging evasion technique with limited tooling around it. Today it appears in campaigns ranging from commodity RATs sold on criminal forums to what looks, based on the obfuscation depth and environmental keying, like nation-state or nation-state-adjacent work. The ecosystem has fully caught up.
What's underreported in coverage of this campaign is how the environmental keying changes the threat model for defenders. Traditional indicators of compromise — file hashes, YARA rules against the final payload — are severely limited when the malware won't execute outside its intended environment. Blue teams accustomed to "grab the sample, run it in a sandbox, extract IOCs" will come up empty on BINDCLOAK unless they can recover the volume serial number of the target machine and reconstruct the decryption key. That's a meaningful capability gap.
The geopolitical framing also deserves scrutiny. East Asian threat actors targeting Middle Eastern government entities fits a well-documented pattern of intelligence collection tied to energy infrastructure, diplomatic positioning, and technology transfer — particularly in the Gulf. The July 7-9 post-compromise activity window suggests this wasn't reconnaissance; the attacker was executing a specific collection tasklist.
For defenders in government and critical infrastructure sectors, the immediate actionable is logging — specifically, monitoring for outbound Telegram API traffic from endpoints that have no business communicating with it, and alerting on scheduled tasks created by parent processes like GoProAlertService.exe. DLL sideloading chains that run through legitimate application directories are detectable if you're watching the right telemetry. Most organizations aren't.
Attribute-based blocking of ISO attachments in email gateways still provides meaningful friction against the initial vector. So does stripping ISO mounting privileges from non-administrative users via Group Policy — friction that doesn't prevent execution but raises the cost of initial access.
— HackWire Editorial
---
## Related Coverage