ZSCALER ThreatLabz revealed the TELESHIM malware, which targets government entities in the Middle East using Telegram for command and control. The attackers employ DLL side-loading techniques, hiding malicious payloads within legitimate software. The malware operates undetected by utilizing regular Telegram API calls, making it blend in with standard web traffic. It establishes persistence through scheduled tasks and employs heavy code obfuscation to hinder analysis.
The campaign, conducted from July 7-9, 2026, indicates a high level of sophistication potentially linked to an unnamed East Asian group. The report emphasizes the risks of espionage for sensitive governmental information and suggests defensive measures such as monitoring unusual DLL activity and blocking specific C2 domains.