{
  "name": "Targeted Attack on Government Entities in the Middle East | Part 1",
  "slug": "targeted-attack-on-government-entities-in-the-middle-east-part-1",
  "description": "In July 2026, a threat actor with links to East Asia launched sophisticated attacks against government entities in the Middle East. The multi-stage campaign deployed previously undocumented malware including TELESHIM, MIXEDKEY, and BINDCLOAK. TELESHIM abuses Telegram API for command-and-control communication to blend with legitimate traffic, while employing heavy code obfuscation techniques like control flow flattening and mixed boolean arithmetic. MIXEDKEY serves as a reflective loader that uses environmental keying by deriving decryption keys from the victim machine's volume serial number. The threat actor demonstrated advanced tradecraft through DLL sideloading, anti-analysis techniques including hypervisor detection and RAM speed checks, and careful staging to evade detection. Post-compromise activity revealed systematic reconnaissance and persistence establishment between July 7-9, 2026, with operations concentrated during East Asian working hours.",
  "published": "2026-07-20T19:29:47.444000+00:00",
  "created_at": "2026-07-21T10:45:08.487000+00:00",
  "modified_at": null,
  "created_at_opencti": null,
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "bindcloak",
    "code obfuscation",
    "dll sideloading",
    "east asia",
    "environmental keying",
    "government targeting",
    "middle east",
    "mixedkey",
    "telegram abuse",
    "teleshim"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "12f4eafb-3a9d-431e-8485-7fa1df6d39c7",
        "name": "3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f"
      },
      {
        "id": "c5f2537b-ebd2-4e4b-a809-bd97add14396",
        "name": "32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66"
      },
      {
        "id": "bcb70636-5db1-42dd-ab33-e960a5b50861",
        "name": "cert.hypersnet.com"
      },
      {
        "id": "f30b402e-30c3-41d8-b2a2-65c1018d51e8",
        "name": "0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9"
      },
      {
        "id": "1aaf4450-a114-41e4-9071-69a96d5e22d3",
        "name": "3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d"
      },
      {
        "id": "892d1fbc-44dc-4b73-9823-47317df1784b",
        "name": "cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be"
      },
      {
        "id": "2d9e4cff-2005-4d97-8f14-8e6c73932ac5",
        "name": "db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b"
      },
      {
        "id": "8d7458a8-2d86-4570-b94b-ae32b26de26f",
        "name": "789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd"
      },
      {
        "id": "db698d4e-f56f-49d9-99a5-36f05a99499e",
        "name": "5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d"
      },
      {
        "id": "5f4b3474-f124-4bb4-be1e-8cb092a9dbcb",
        "name": "c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f"
      }
    ],
    "attack_patterns": [
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "c998d878-b668-40dd-a84c-9ca7f73caaa4",
        "name": "T1497.003"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "ccb28547-a340-4193-a5d9-69222f3d5051",
        "name": "T1049"
      }
    ],
    "malware": [
      {
        "id": "baa68054-f7bd-4361-8bf0-d840933ab63b",
        "name": "TELESHIM",
        "slug": "teleshim"
      },
      {
        "id": "5911fb80-dc63-4372-95a2-a774f0e0d0ff",
        "name": "BINDCLOAK"
      },
      {
        "id": "b76f46cf-0da4-4c5e-b6f4-8fe0653f1b80",
        "name": "MIXEDKEY"
      }
    ],
    "observables": [
      {
        "id": "bd2d3e29-024f-428b-9c34-2e5aa32b1999",
        "name": "cert.hypersnet.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "82752768-9837-4207-9888-6e3960f34042",
      "standard_id": "external-reference--19eb8b96-e066-5d4c-9ddd-35dfc813754f",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1",
      "hash": null,
      "external_id": null,
      "created": "2026-07-21T10:45:05.599Z",
      "modified": "2026-07-21T10:45:05.599Z",
      "createdById": null
    },
    {
      "id": "0af02353-7ab7-4113-ae2a-65929f9f353a",
      "standard_id": "external-reference--a0c1acc1-e7bc-5668-832b-2b2835a98ca3",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a5e772bc58d968a512e89c4",
      "hash": null,
      "external_id": "6a5e772bc58d968a512e89c4",
      "created": "2026-07-21T10:45:05.576Z",
      "modified": "2026-07-21T10:45:05.576Z",
      "createdById": null
    }
  ]
}