How Hackers Are Using Telegram to Target Governments in the Middle East

Robert Moore · 2026-07-27

Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month. ### What's Really Going On? When you hear about state-backed hackers, you probably picture secret labs and complex code. But here's the twist: these attackers are using a tool you probably have on your phone right now. Telegram. Yes, that messaging app with the cute stickers and group chats. They're using it as a command-and-control (C2) channel to orchestrate attacks on government networks. It's clever, it's sneaky, and it's a wake-up call for anyone who thinks security is just about firewalls. ### The Malware Trio You Need to Know About The researchers identified three distinct malware families in this campaign. Each one plays a specific role in the attack chain. Let me break them down for you. - **TELESHIM**: This is the initial access malware. It uses Telegram's API to receive commands from the attacker. Think of it as a digital stowaway that hitches a ride on a legitimate app. - **MIXEDKEY**: A keylogger and data stealer. Once inside, this malware records keystrokes and captures screenshots. It's like having a spy watch over every move you make on your keyboard. - **BINDCLOAK**: A backdoor that provides persistent access. It lets the attacker come and go as they please, grabbing files or installing more tools. These aren't just random names. Each piece of malware is designed to work together, creating a seamless pipeline from initial breach to full compromise. And the fact that they're using Telegram makes detection much harder because the traffic looks normal. ### Why Telegram? You might be wondering: why Telegram? Why not some custom-built C2 server? The answer is simple. Telegram is everywhere. It's used by millions of people worldwide for legitimate communication. That makes it incredibly difficult for network security tools to distinguish between a harmless chat and a malicious command. The attackers are essentially hiding in plain sight. > "Using a popular platform like Telegram for C2 is a classic example of living off the land. It's not about breaking in with brute force anymore. It's about blending in." This approach also gives the attackers flexibility. They can create new channels, delete old ones, and change their communication patterns on the fly. It's a moving target that keeps defenders guessing. ### What This Means for Security Pros If you're responsible for securing a network, this campaign should raise some red flags. Traditional signature-based detection won't catch this. You need to look for behavioral anomalies. Sudden spikes in Telegram API calls from a single workstation. Unusual data exfiltration patterns. These are the signs that something might be off. Here's what I recommend: - Monitor outbound traffic to messaging platforms like Telegram. Know what normal looks like for your environment. - Implement application whitelisting to prevent unauthorized software from running. - Train your users to recognize suspicious activity, even if it comes through a familiar app. ### The Bigger Picture This isn't just about one campaign. It's a trend. Threat actors are getting smarter about using legitimate services for malicious purposes. We've seen it with Discord, Slack, and now Telegram. The lesson is clear: you can't rely on blocking tools alone. You need to understand how your network behaves and be ready to spot the outliers. For antidetect browser professionals, this is especially relevant. If you're managing multiple profiles or testing environments, you need to be aware that the same tools you use for privacy can be weaponized by adversaries. Stay vigilant. Keep your systems updated. And always question the traffic that looks too normal.