When Malware Sends a Message: How TELESHIM Turned Telegram into a Command-and-Control Channel

Javier Conejo del Cerro
27 jul
2 min de lectura

Security teams are trained to look for suspicious domains, unknown servers, and malicious infrastructure.

TELESHIM takes a different approach.

Instead of hiding its communications, it hides them inside one of the world’s most trusted messaging platforms. By abusing the Telegram API as its command-and-control channel, the malware blends seamlessly into legitimate internet traffic while quietly maintaining access to targeted government networks across the Middle East.

The attack isn’t hiding the message.

It’s hiding where the message travels.

Phase 1 – Entering Through Trusted Components

The intrusion begins with an ISO file containing a legitimate Windows executable that side-loads a malicious DLL.

That DLL is TELESHIM, the first-stage backdoor responsible for establishing persistence and initiating communications with the attacker through Telegram.

By abusing legitimate executables and DLL side-loading, the attackers reduce the likelihood of raising immediate security alerts.

Phase 2 – Turning Telegram into Command Infrastructure

Rather than connecting to suspicious attacker-controlled servers, TELESHIM communicates through the Telegram API.

The malware registers newly infected systems, receives commands, exfiltrates execution results, and downloads additional payloads—all while its traffic resembles ordinary Telegram communications.

The infrastructure defenders trust becomes the infrastructure attackers use.

Phase 3 – Building a Multi-Stage Espionage Platform

TELESHIM downloads additional components, including MIXEDKEY and the final BINDCLOAK implant.

These payloads rely on multiple layers of encryption, reflective loading, environment-specific decryption keys, and extensive code obfuscation to frustrate reverse engineering.

The malware also performs virtualization checks and activates only when it detects the intended victim environment, reducing the risk of exposure during security analysis.

Phase 4 – Blending In Is the New Stealth

Following compromise, operators performed reconnaissance, executed remote commands, deployed additional payloads, and maintained persistent access while their communications blended into legitimate cloud traffic.

The campaign illustrates a growing trend in advanced threat operations: attackers no longer need to hide their traffic.

They only need to make it look normal.

Trusted platforms, encrypted services, and legitimate APIs are increasingly becoming part of the attack infrastructure itself.

Defense Measures

Organizations should strengthen detection by:

Monitoring trusted cloud services for anomalous API usage.
Hunting for DLL side-loading behavior.
Detecting heavily obfuscated executables and reflective loaders.
Monitoring virtualization-aware malware behavior.
Correlating endpoint, identity, and network telemetry.
Inspecting encrypted service usage for behavioral anomalies rather than destination alone.
Continuously monitoring persistence mechanisms and post-compromise activity.