Zscaler ThreatLabz has uncovered a new East Asia–linked campaign targeting Middle Eastern government entities using three (3) previously unseen malware families: TELESHIM, MIXEDKEY, and BINDCLOAK. The attack starts with an ISO containing a legitimate executable that DLL-sideloads TELESHIM, a 32-bit backdoor that uses the Telegram API for command-and-control to pull next-stage payloads. TELESHIM then helps launch a second DLL sideloading chain, where MIXEDKEY acts as a reflective loader to decrypt and run a heavily obfuscated payload. Both TELESHIM and MIXEDKEY use string encryption, control-flow flattening, mixed boolean arithmetic, and VM checks to evade analysis. TELESHIM supports control messages (host registration, command execution, chunked exfiltration) and download/execute messages for scheduled secondary payloads. The final stage, BINDCLOAK, is a 64-bit C++ implant that contacts cert.hypersnet[.]com and supports post-compromise reconnaissance and follow-on payload delivery. The final payload is protected by two layers of XOR encryption, including environmental keying tied to the victim’s volume serial number, ensuring it runs only on intended systems.