This threat involves a targeted attack campaign against Middle Eastern government entities by an East Asia-linked actor using previously undocumented malware. TELESHIM leverages Telegram API for command-and-control, blending malicious traffic with legitimate communications and employing control flow flattening and mixed boolean arithmetic for obfuscation. MIXEDKEY acts as a reflective loader that derives decryption keys from the victim machine's volume serial number, implementing environmental keying to hinder analysis. The campaign uses DLL sideloading for execution, anti-analysis techniques including hypervisor detection and RAM speed checks, and carefully staged operations to avoid detection. Post-compromise activity between July 7-9, 2026, included systematic reconnaissance and persistence establishment, with operations timed to East Asian working hours. No known exploits in the wild or patches are reported, and the threat targets specific government entities in the Middle East.

The campaign enables persistent unauthorized access to targeted government networks in the Middle East, facilitating reconnaissance and potential further malicious activity. The use of novel malware with advanced evasion and obfuscation techniques complicates detection and response efforts. The environmental keying and anti-analysis methods increase the difficulty of forensic investigation and malware removal. Although no direct exploitation of software vulnerabilities is described, the threat actor's advanced tradecraft poses a significant risk to confidentiality and operational security of affected entities.

No official patches or fixes are available as this campaign uses custom malware and tradecraft rather than exploiting known software vulnerabilities. Organizations should focus on detection and response capabilities tailored to the described malware behaviors, such as monitoring for abnormal Telegram API usage, DLL sideloading patterns, and indicators of environmental keying. Enhanced endpoint detection and response (EDR) solutions capable of identifying obfuscation and anti-analysis techniques are recommended. Incident response teams should review network and host telemetry for signs of the described malware families and tactics. Since this is a targeted campaign, organizations in the Middle East government sector should increase vigilance and threat hunting efforts accordingly.