Telegram Bots Exploited as Backdoors in Government Systems

Key Takeaways

• A newly identified cyberespionage campaign is leveraging Telegram bots to establish covert backdoors within government networks in the Middle East.
• The attack chain initiates with an ISO image containing a legitimate ASUSTek executable (`RegSchdTask.exe`) alongside a malicious DLL, exploiting DLL sideloading.
• The primary backdoor, TELESHIM, communicates with attackers via Telegram’s Bot API, blending malicious traffic with legitimate service communications.
• Subsequent stages deploy MIXEDKEY and the BINDCLOAK implant, with MIXEDKEY using a unique device identifier for payload decryption, hindering analysis.
• The threat actor, assessed to be based in East Asia, uses anti-analysis techniques to evade detection and maintain persistence through scheduled tasks.

A sophisticated cyberespionage operation has been uncovered, transforming Telegram bots into stealthy command and control (C2) channels for backdoors embedded within government systems across the Middle East. This campaign leverages standard Windows components and seemingly legitimate files to gain and maintain persistent access, effectively evading immediate detection.

The attack, detailed in a report by Zscaler researchers, highlights a concerning trend where widely used communication platforms are weaponized for covert operations. Zscaler identified this activity in July 2026, attributing it to an East Asia-linked actor targeting government entities.

Initial Intrusion and TELESHIM Backdoor

The infection chain begins with a malicious ISO image. This image contains a genuine ASUSTek program, RegSchdTask.exe, paired with a harmful dynamic-link library (DLL). When the legitimate program is executed, it inadvertently loads the attacker’s malicious DLL, a technique known as DLL sideloading. This initial compromise initiates a multi-stage infection process, ultimately deploying TELESHIM, MIXEDKEY, and the BINDCLOAK implant.

TELESHIM acts as the first-stage backdoor, utilizing Telegram’s Bot API for its command and control infrastructure. This method allows malicious traffic to masquerade as benign communications with a legitimate online service, making it difficult to detect. The backdoor specifically checks for messages directed at the infected machine’s unique network identifier, ensuring that commands are executed only on the intended target.

This design provides the attackers with a low-profile mechanism for managing compromised systems. Instead of directly connecting to a suspicious C2 server, the malware periodically queries Telegram for instructions. It then executes these commands using standard Windows tools and transmits encrypted results back through the bot interface. TELESHIM also facilitates the remote delivery of additional files, which are decrypted locally and launched via scheduled tasks, establishing persistence even after system restarts.

Before initiating its core functions, TELESHIM incorporates several anti-analysis techniques. It checks for virtualized environments, analyzes memory characteristics, performs extensive disk activity, and obfuscates text strings. These measures are designed to hinder automated scanning and manual reverse engineering efforts by security researchers.

Multi-Stage Intrusion Chain

Following the initial foothold, the operators conduct extensive reconnaissance, gathering information about the victim’s system, users, network configurations, and files. This intelligence-gathering phase is crucial for understanding the environment and planning subsequent actions.

After reconnaissance, the attackers select a staging location and deploy MIXEDKEY, the second-stage loader. MIXEDKEY employs another DLL sideloading tactic, utilizing a legitimate executable with a malicious DLL to load its components. This loader decrypts its payload using the infected device’s volume serial number as part of the decryption key. This unique key ensures that the final implant functions only on the specific target machine, making it less useful for security analysts attempting to reverse engineer it on other systems.

The final payload in this chain is BINDCLOAK, a 64-bit implant that establishes communication with an attacker-controlled domain. Zscaler assessed with moderate-to-high confidence that the operators are based in East Asia, although they did not link this activity to any previously known threat groups. The sophistication of the attack, particularly the use of Telegram for C2 and the tailored payloads, underscores the evolving tactics of cyberespionage actors.

What You Should Do

• Monitor for Unusual Files: Scrutinize unexpected ISO files, especially those delivered via email or untrusted sources.
• Detect DLL Sideloading: Implement robust endpoint detection and response (EDR) solutions to detect abnormal DLL loading alongside legitimate programs, particularly for executables like RegSchdTask.exe.
• Inspect Scheduled Tasks: Regularly audit newly created or modified scheduled tasks for suspicious entries that could indicate persistence mechanisms.
• Analyze Network Traffic: Monitor network traffic for unusual communications with Telegram’s Bot API from government workstations, especially in environments where Telegram is not officially sanctioned or necessary for business operations.
• Stay Informed on DLL Sideloading: Keep abreast of the latest intelligence on DLL sideloading malware activity and implement corresponding detection rules and mitigations.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.