New TELESHIM Malware Uses Telegram for C2 in Attacks Against Middle East Governments

New Malware Campaign Discovered

Cybersecurity researchers from Zscaler ThreatLabz have identified a new malicious cyber campaign attributed to a threat actor with ties to East Asia. This campaign specifically targets government entities located in the Middle East. The intrusions were detected earlier this month and involve the deployment of previously unreported malware families.

TELESHIM Leverages Telegram for C2

The primary malware family, dubbed TELESHIM, utilizes the Telegram API for its command-and-control (C2) communications. This method allows the malware to disguise its malicious traffic as legitimate internet activity, making it harder to detect. The attack chain begins with an ISO file containing a legitimate executable that sideloads a rogue DLL, which is the 32-bit Windows backdoor TELESHIM.

Multi-Stage Attack Chain and Obfuscation

The campaign employs a multi-stage attack chain to establish and maintain access on infected systems. TELESHIM retrieves next-stage components, including MIXEDKEY, which acts as a reflective loader. Both TELESHIM and MIXEDKEY incorporate extensive code obfuscation techniques, such as string encryption, control flow flattening, and mixed boolean arithmetic, to hinder reverse engineering efforts. TELESHIM also includes methods to detect virtualization-based analysis environments, such as Hypervisor detection using CPUID and RAM speed checks via Windows Management Instrumentation (WMI).

Encrypted Payloads and Environmental Keying

TELESHIM's C2 communications support control messages for host registration and command execution, as well as download and execute messages for secondary payloads. The final payload is protected by two layers of XOR encryption. The second layer uses environmental keying, where the decryption key is derived from the infected machine's volume serial number, ensuring the malware only detonates on its intended target.