TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments

Cybersecurity researchers have identified a new malicious campaign targeting Middle East government entities, attributed to a threat actor linked to East Asia. The campaign has involved the deployment of newly discovered malware families, including TELESHIM, MIXEDKEY, and BINDCLOAK. The malware uses Telegram for command and control purposes. The campaign was detected earlier this month by Zscaler ThreatLabz. The threat actor's use of Telegram for C2 is a notable aspect of the attacks. The malware families used in the campaign were previously unreported.