On July 7, 2026 Zscaler ThreatLabz flagged a fresh campaign that’s abusing the Telegram API for command‑and‑control, a technique that’s catching a lot of attention because it blends malicious traffic with everyday chat messages. The researchers say the threat actor, which appears to be based in East Asia, has already compromised multiple government entities across the Middle East.
Key Takeaways
- TELESHIM uses Telegram as a C2 channel, masking traffic as legitimate chat.
- Heavy obfuscation—string encryption, CFF, MBA—makes reverse engineering hard.
- Two‑stage side‑loading chains deliver MIXEDKEY and BINDCLOAK payloads.
- Commands run only between 4 a.m. and 12 p.m. UTC, peaking at 7 a.m.‑11 a.m. UTC.
- Attribution points to an East Asian source, but no known group is claimed.
Historical Context
For several years, adversaries have favored trusted communication services to hide their traffic. The appeal lies in the fact that many corporate firewalls permit the underlying protocols without inspection. Telegram, with its encrypted API and global reach, became a natural choice for this purpose. Earlier campaigns demonstrated similar tactics, using the platform to deliver simple command strings or to exfiltrate small data blobs. Those incidents laid the groundwork for the more sophisticated approach seen in the current campaign, where the C2 channel is woven into a multi‑stage infection chain.
What changed this time? Attackers added a second‑stage loader, layered encryption, and strict time windows for command execution. The evolution reflects a broader trend: as defenders improve detection of basic Telegram traffic, threat actors respond by increasing complexity. The incremental steps taken over the past decade illustrate a learning curve that mirrors the arms race between security teams and malicious groups.
Telegram C2 Malware: How TELESHIM Operates
What’s surprising is that the initial drop is an ISO file that looks innocent, containing a legitimate executable named “RegSchdTask.exe.” That file then sideloads a rogue DLL called “AsTaskSched.dll,” which is the 32‑bit Windows backdoor the researchers call TELESHIM. Once it’s on the system, TELESHIM reaches out to Telegram’s API, pulling C2 instructions that look like any other chat message.
“The campaign used a multi‑stage attack chain to establish and maintain access on infected systems, with TELESHIM abusing the Telegram API for command‑and‑control (C2) communication to blend in with legitimate internet traffic,” Sudeep Singh, senior manager of APT research at Zscaler ThreatLabz, said.
That blend is the real danger. Because Telegram traffic is usually allowed through firewalls, security teams might miss the malicious calls entirely. The C2 messages come in two flavors: control messages that register the host by sending its MAC address and execute commands, and download‑and‑execute messages that pull secondary payloads as scheduled tasks.
Control Message Mechanics
Control messages are clever. They split exfiltrated data into chunks if the output exceeds 1,000 bytes, sending each piece back to the Telegram server. That chunking avoids triggering size‑based alerts that many EDR tools rely on.
Side‑Loading Chains and Obfuscation Tactics
After TELESHIM establishes a foothold, the attackers launch a second DLL side‑loading chain. It starts with “GoProAlertService.exe,” which loads “pthreadVC2.dll.” That DLL acts as a reflective loader codenamed MIXEDKEY, decrypting a file named “C99F29AC08454855B3D538960BB2F34F.PCPKEY” and executing it.
Both TELESHIM and MIXEDKEY are heavily obfuscated. They use string encryption, control‑flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates. Those tricks raise the bar for anyone trying to reverse‑engineer the code. TELESHIM also checks for virtualized analysis environments, using CPUID to detect hypervisors and querying RAM speed via Windows Management Instrumentation (WMI). That’s a clear sign the authors expect skilled analysts to dig into their binaries.
- String encryption hides readable strings.
- Control‑flow flattening scrambles execution order.
- Mixed boolean arithmetic makes mathematical logic opaque.
- Opaque predicates add dead code pathways.
- Environmental keying encrypts the final payload using the machine’s volume serial number.
The final payload, BINDCLOAK, is a 64‑bit C++ implant that contacts an external server at “cert.hypersnet[.]com.” That server is the ultimate C2 hub, handing out the next stages of the attack. The layered encryption—two XOR rounds, the second keyed to the victim’s volume serial—means the malware only detonates on the intended target. That specificity suggests the actors have a precise list of victims they care about.
Timing, Geography, and Attribution
ThreatLabz tracked post‑compromise activity between July 7 and July 9, 2026. All C2 commands were executed between 4 a.m. and 12 p.m. UTC, with a heavy concentration between 7 a.m. and 11 a.m. UTC. That narrow window hints at a disciplined operational schedule, perhaps aligning with the threat actor’s local working hours.
Based on the public IP address, the system locale on the Windows server, and the geolocation of that IP, the researchers assess with moderate‑to‑high confidence that the campaign originates from East Asia. No known APT group has claimed responsibility, so the actors remain unattributed for now.
Implications for Defenders and Developers
What’s concerning is how the campaign mirrors broader trends: EDR evasion, abuse of trusted platforms, and heavy code obfuscation. If you’re running a Windows environment that allows scheduled tasks, you might already be vulnerable to the side‑loading technique. And because the C2 traffic looks like normal Telegram chats, network‑level detection is tougher than it used to be.
Developers should remember that DLL side‑loading can be triggered by any legitimate executable that loads external modules. Hardening the loading process—verifying digital signatures, restricting write permissions on system directories, and monitoring for unexpected DLL loads—can cut down the attack surface.
What This Means For You
If you manage government or enterprise Windows endpoints, you need to start treating Telegram traffic as potentially malicious. Enable deep packet inspection that can differentiate between standard chat messages and the specific C2 patterns described by ThreatLabz. Also, audit scheduled task creation for anomalies, especially tasks that invoke unknown executables like “GoProAlertService.exe.”
For developers building security tooling, the layered XOR and environment‑keyed encryption show that attackers are willing to invest in sophisticated payload delivery. Your detection rules should therefore look for the tell‑tale signs of virtualization checks—CPUID queries and WMI RAM speed checks—because those are reliable indicators of analysis‑evasion attempts.
Going forward, the question is whether more threat actors will adopt mainstream messaging platforms for C2, effectively turning everyday apps into covert conduits for espionage. If that shift accelerates, how will defenders balance privacy expectations with the need for aggressive monitoring?
Concrete Scenarios for Practitioners
Scenario 1: A national IT department discovers a new scheduled task named “GoProAlertService.exe” on a critical server. The executable has no known digital signature and resides in a non‑standard path. By cross‑referencing the task’s creation time with the observed 4 a.m.–12 p.m. UTC window, analysts can flag the activity as suspicious and isolate the host before the BINDCLOAK payload contacts its external server.
Scenario 2: A multinational corporation with remote employees notices an uptick in outbound TLS connections to Telegram endpoints during the early morning hours of the Europe/UTC timezone. Network sensors, tuned to the specific payload‑fetch pattern—download‑and‑execute messages that reference “C99F29AC08454855B3D538960BB2F34F.PCPKEY”—trigger an alert, prompting an investigation that uncovers a side‑loaded DLL on a laptop used by a senior manager.
Scenario 3: A security‑as‑a‑service vendor integrates a new heuristic that inspects process memory for the presence of encrypted strings matching the pattern used by TELESHIM. When the heuristic fires, it automatically initiates a sandbox analysis that checks for CPUID‑based hypervisor detection. The sandbox detects the anti‑analysis checks, allowing the vendor to quarantine the sample before it reaches production environments.
Competitive Landscape
While TELESHIM is the latest publicized example, other threat groups have experimented with similar approaches. Some have used alternative messaging APIs, but the core idea—masking C2 within everyday communication—remains consistent. The competition drives continuous refinement of obfuscation methods, pushing adversaries toward more layered encryption and tighter time‑bound command windows. This pressure forces defenders to adopt equally layered detection strategies, combining network‑level heuristics with host‑based behavioral analytics.
Key Questions Remaining
- Will the use of mainstream messaging platforms become a standard C2 practice across multiple threat actor families?
- How can organizations balance the privacy guarantees of services like Telegram with the need for deep inspection of potentially malicious traffic?
- What additional hardening steps can be taken to mitigate DLL side‑loading without disrupting legitimate software updates?
Answers to these questions will shape the next generation of defensive tooling and policy decisions. As the threat landscape evolves, staying ahead requires both technical vigilance and strategic foresight.
Sources: The Hacker News, Zscaler ThreatLabz
