New TELESHIM Malware Uses Telegram Bots to Backdoor Middle East Government Systems

The operation deploys previously undocumented malware called TELESHIM, MIXEDKEY, and BINDCLOAK, while using Telegram bots as a command-and-control channel. In July 2026, researchers observed post-compromise activity linked with moderate-to-high confidence to an East Asia-based threat actor. The group has not yet been tied to a known APT, but its operational timing, infrastructure evidence, and system locale indicators support the assessment. TELESHIM Targets Middle East…

Diamond Model