China-Linked Hackers Hit Middle East Governments With New Malware That Hides in Telegram
Zscaler researchers say a group tied to East Asia is running fresh spy operations against government networks, using three never-before-seen tools.
Key points
- Zscaler ThreatLabz detected a new spying campaign against Middle Eastern government bodies earlier this month.
- The attackers are linked to East Asia and are believed to be state-aligned.
- Two of the three new malware families, TELESHIM and BINDCLOAK, handle remote access and concealment respectively.
- TELESHIM abuses the Telegram messaging service to receive orders from its operators.
- No victim names, ransom demands or data leaks are involved. This looks like classic espionage.
Government offices in the Middle East are the latest target of a hacking crew that researchers say has ties to East Asia, with quiet intelligence gathering as the goal.
Zscaler ThreatLabz, the research arm of a cloud security firm, flagged the activity earlier this month. The Hacker News first reported on the findings.
Who is behind this?
Zscaler attributes the intrusions to a group with links to East Asia. No specific country or crew has been named publicly, but the profile fits a state-aligned espionage operation rather than a criminal one. There's no leak site, no ransom note, no public list of victims. Spies want to stay inside networks and read what's there, not announce themselves.
Unlike ransomware gangs that dominate cybercrime headlines, groups of this type don't lock files or demand payment. They sit quietly and collect. It's a pattern we've tracked before: our 23 July story on a misconfigured Alibaba Cloud server that exposed a China-linked loader targeting hospitals and governments showed the same patient, tooling-heavy approach.
What is the new malware?
The researchers documented three tools not seen before, each doing a distinct job in the attack chain.
| Malware | Role |
|---|---|
| TELESHIM | Backdoor that takes orders through Telegram |
| MIXEDKEY | Custom loader that decrypts and runs the next stage |
| BINDCLOAK | Component used to hide the attackers' presence on the machine |
A backdoor is a hidden program that lets an outsider control a computer remotely. A loader is a smaller program whose only job is to unpack and start the main malware, often to slip past antivirus scanners.
TELESHIM is the most notable. It uses Telegram as its command channel, meaning attackers can send instructions to infected government computers through a Telegram bot, and the malware quietly reads them.
Why does using Telegram matter?
It hides in normal traffic. Most government offices don't block Telegram, and its servers look harmless to security tools. Malware phoning home to an obscure foreign address stands out. Malware talking to Telegram doesn't.
This technique, sometimes called "living off trusted services," has spread steadily. Spies and criminals have pressed Discord, Slack and GitHub into the same role. Defenders end up chasing a needle in a very large, very legitimate haystack. HollowGraph, the espionage toolset we reported on 20 July, used Microsoft 365 calendar events the same way: a trusted platform turned into a covert inbox.
Should ordinary people worry?
Not directly. The targets here are government agencies and the aim is espionage. Members of the public aren't being scammed or having accounts drained.
The wider point is plain enough. Foreign intelligence services keep hammering Middle Eastern government networks, and their tools keep getting quieter. For anyone working inside those agencies, unusual Telegram traffic on office machines is now a warning sign worth acting on.
Zscaler hasn't disclosed which countries were hit, how the attackers first got in, or how long they were inside before being noticed. Those details tend to surface in follow-up work from incident responders. For now, what matters is the toolkit: three fresh pieces of malware, one of them phoning home through an app on almost everyone's phone.
