East‑Asia actor hijacks Telegram API for C2 in Middle East government attacks
Zscaler ThreatLabz discovered a July 2026 campaign targeting Middle‑East government networks, deploying three previously unknown malware families—TELESHIM, MIXEDKEY and BINDCLOAK. TELESHIM uses the Telegram API as a covert C2 channel, blending traffic with legitimate messages, while heavy obfuscation and environment‑keyed encryption make detection hard. The operation is tied to an actor with East‑Asian links.