Zscaler uncovers targeted attack on Middle East government entities

Zscaler ThreatLabz has detailed a campaign targeting government entities in the Middle East, attributed with moderate-to-high confidence to a threat actor operating out of East Asia. The multi-stage attack chain deploys previously undocumented malware, including the TELESHIM backdoor, which abuses the Telegram API for command-and-control, and the MIXEDKEY reflective loader. The final payload, BINDCLOAK, is encrypted using environmental keying tied to the victim’s volume serial number. Zscaler has released indicators of compromise and detection coverage.