Targeted Attack on Government Entities in the Middle East

Date: 07/21/2026

Severity: High

Summary

A suspected East Asia-linked threat actor conducted a multi-stage cyberespionage campaign targeting government entities in the Middle East, deploying the previously undocumented malware TELESHIM, MIXEDKEY, and BINDCLOAK. The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.

Indicators of Compromise (IOC) List

Domains/URLs

cert.hypersnet.com

Hash

97124a93766be732e8fef5a56a5346a2

C1f16e31ae71372ee45fa6fd6927c7b887a4e3f2

789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd

68926e6c958562deaae35de3d9f59de3

Ccb2002fe8f5cc1f511d52309625b52d1c507421

c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f

087499849115eb28c4364581d2b28d09

86ee99f293a30720bcc898a4a8e391f93fb9be95

32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66

B776eb638fbb535708fb92b12fcc1731

2377c47cfde148c2140faa7105628174f9c4d56d

db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b

7cbc51ada1a4aec88660ec32c408114b

F46c01a5be2e08e36d4ec3302a8650a6ed25ec14

5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d

3f60d53a2b5737d77e058d9e33cbe9eb

1099bf51e53bd5fb32401edb4e0be841d8486b19

cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be

28b47bdf16d7af6f8ec21218eac9145a

Fee6806c96f87bf1e240a2eb6fd7e045101d58d3

0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9

78a4f8574830bf7fbaf63d7da09be2b8

Ee287d6a09295502ab2407aec336f9f0d8477d68

3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f

7a14a99d70d42d3f7bf72f843185fc07

577b1cc894636f4ac5ad670b0079b9b7ade137c3

3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Detection Query 1 :	domainname like "cert.hypersnet.com" or url like "cert.hypersnet.com" or siteurl like "cert.hypersnet.com"
Detection Query 2 :	`md5hash IN ("3f60d53a2b5737d77e058d9e33cbe9eb","087499849115eb28c4364581d2b28d09","B776eb638fbb535708fb92b12fcc1731","28b47bdf16d7af6f8ec21218eac9145a","7cbc51ada1a4aec88660ec32c408114b","97124a93766be732e8fef5a56a5346a2","68926e6c958562deaae35de3d9f59de3","78a4f8574830bf7fbaf63d7da09be2b8","7a14a99d70d42d3f7bf72f843185fc07")`
Detection Query 3 :	`sha1hash IN ("86ee99f293a30720bcc898a4a8e391f93fb9be95","2377c47cfde148c2140faa7105628174f9c4d56d","1099bf51e53bd5fb32401edb4e0be841d8486b19","Fee6806c96f87bf1e240a2eb6fd7e045101d58d3","F46c01a5be2e08e36d4ec3302a8650a6ed25ec14","C1f16e31ae71372ee45fa6fd6927c7b887a4e3f2","Ccb2002fe8f5cc1f511d52309625b52d1c507421","Ee287d6a09295502ab2407aec336f9f0d8477d68","577b1cc894636f4ac5ad670b0079b9b7ade137c3")`
Detection Query 4 :	sha256hash IN ("5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d","db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b","cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be","0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9","32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66","789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd","c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f","3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f","3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d")

Reference:

https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1#indicators-of-compromise--iocs-

Targeted Attack on Government Entities in the Middle East

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Comments

Targeted Attack on Government Entities in the Middle East

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Share This

Comments