Zscaler ThreatLabz has discovered a new campaign targeting government organizations in the Middle East. Researchers linked the activity to a threat actor believed to be operating from East Asia, but didn't attribute the operation to any known advanced persistent threat (APT) group.
The attack begins with a malicious ISO image containing a legitimate ASUSTek RegSchdTask.exe executable and a malicious AsTaskSched.dll file. The trusted application sideloads the attacker’s DLL, starting a multi-stage infection chain that deploys three previously undocumented malware families called TELESHIM, MIXEDKEY, and BINDCLOAK.
TELESHIM serves as the initial backdoor and uses the Telegram API for command-and-control (C&C) communications. Instead of connecting to dedicated attacker-controlled infrastructure, the malware polls messages from a specific Telegram chat, executes commands intended for the infected system’s unique network identifier, and returns encrypted results. It can also receive encrypted payloads through Telegram, decrypt them locally, and execute them using Windows scheduled tasks.
Both TELESHIM and MIXEDKEY use advanced code obfuscation techniques, including control flow flattening (CFF), mixed boolean arithmetic (MBA), and opaque predicates. TELESHIM also includes virtualization detection methods to identify analysis environments.
BINDCLOAK, which is the final-stage implant, uses environmental keying to limit execution to intended targets. Its payload is encrypted with a key derived from the infected system’s Windows volume serial number, preventing successful decryption on unauthorized systems.
During post-compromise analysis, ThreatLabz found indicators including the threat actor’s public IP address and Windows system locale. Combined with geolocation data and operational activity that matched East Asian working hours, the researchers assess with moderate-to-high confidence that the operator is based in East Asia.