Hackers Use Telegram Bots as Covert Command-and-Control for Government Backdoors
A cyberespionage campaign is leveraging Telegram bots to control backdoors within Middle Eastern government networks, using the popular messaging app to mask malicious communications.
A sophisticated cyberespionage campaign has been discovered where threat actors are exploiting Telegram bots to act as covert command-and-control (C2) channels for backdoors implanted in the networks of Middle Eastern government entities. This operation, identified by researchers at Zscaler, utilizes a multi-stage attack chain that begins with seemingly innocuous ISO images containing legitimate Windows executables paired with malicious DLLs.
The initial infection vector involves an ISO file that, when opened, executes a legitimate ASUSTek RegSchdTask.exe program. However, this program is designed to load a malicious companion DLL, initiating a chain of events that ultimately deploys custom malware. The malware suite includes TELESHIM, MIXEDKEY, and the BINDCLOAK implant, each playing a specific role in establishing and maintaining persistence within the compromised systems.
TELESHIM, the first backdoor in the chain, is engineered to communicate with Telegram's Bot API. This allows attackers to send commands and exfiltrate data by disguising malicious traffic as legitimate communications with the widely used messaging service. The malware is designed to only respond to commands specifically addressed to the infected machine's unique network identifier, providing a low-profile method for remote management.
To ensure persistence, the attackers employ scheduled tasks, a common technique that allows malware to re-establish itself even after a system reboot. TELESHIM can also receive files via the bot interface, decrypt them locally, and then execute them using these scheduled tasks. Before commencing its primary operations, the backdoor incorporates anti-analysis techniques, including checks for virtualized environments, memory examination, and string obfuscation, all aimed at slowing down both automated and manual security investigations.
Following the initial compromise, the threat actors conduct extensive reconnaissance, gathering information about the system, user, network, and file structures to understand the victim environment. They then use a staging location to deploy the next stage of the attack, often involving a legitimate executable that loads a malicious DLL through a technique known as DLL sideloading.
The second-stage loader, MIXEDKEY, is responsible for decrypting a subsequent payload. It uses the infected device's volume serial number as part of its decryption key, a tactic that customizes the final implant to work only on the intended victim, thereby hindering analysis of recovered malware samples.
The final payload, BINDCLOAK, is a 64-bit implant that establishes communication with an attacker-controlled domain. While Zscaler assesses with moderate-to-high confidence that the operator is based in East Asia, they have not yet linked the activity to a specific known threat group. The campaign highlights the growing trend of using legitimate services like Telegram for C2 infrastructure, making detection more challenging.
Security defenders are advised to scrutinize unexpected ISO files, monitor for abnormal DLL loading alongside trusted programs, and investigate newly created scheduled tasks. Additionally, unusual Telegram API traffic from workstations where the service is not officially required should be a significant red flag, prompting further investigation into potential DLL sideloading malware activity.