Home › Threat Actors › Unknown East Asia-Linked APT
← All Threat Actors
Nation-State high East Asia (assessed); no specific country, sponsor or named cluster confirmed

Unknown East Asia-Linked APT

Unattributed. Zscaler ThreatLabz assesses the actor as East Asia-linked with moderate-to-high confidence (Part 1) based on IP geolocation, system locale and C2 working hours of 04:00–12:00 UTC; no named APT group. Part 2 (3 August 2026) assesses with high confidence that BINDCLOAK is a variant of OctLurk. · Intelligence collection / espionage — purpose-built tooling designed for sustained, long-term covert access rather than smash-and-grab theft.

Reports 1
Active Since Activity tracked since January 2025 via OctLurk; TELESHIM compiled July 2026; Zscaler Part 1 published 20 July 2026
Last Reported 29 Jul 2026
Sectors Targeted government, diplomatic

Tactics, Techniques & Procedures (TTPs)

  • Initial access via weaponized ISO files (bypasses Mark-of-the-Web) containing a legitimate signed ASUS binary (RegSchdTask.exe) that sideloads a malicious DLL (AsTaskSched.dll) — the TELESHIM first-stage loader
  • TELESHIM: anti-virtualization/anti-sandbox checks; C2 via Telegram API calls that blend with legitimate Telegram traffic; triple-layered obfuscation combining control flow flattening, mixed boolean arithmetic, and opaque predicates
  • MIXEDKEY: second-stage loader using the same DLL-sideloading mechanic, which reflectively loads the final implant directly into memory without writing it to disk
  • BINDCLOAK: 64-bit final implant encrypted with a key derived from the infected machine's volume serial number ('environmental keying'), rendering extracted samples cryptographically inert off the original target machine; communicates with C2 domain cert.hypersnet[.]com
  • Delivery as a ZIP containing an ISO; scheduled-task persistence: "shimgen" every 6 minutes (TELESHIM) and "Feedback" every 10 minutes (MIXEDKEY)
  • BINDCLOAK is a modular C++ backdoor with message-routing C2 and EDR evasion aimed at API calls from unbacked executable memory
  • Infrastructure reuse: Tucows registrar, Njalla name servers and ASN 14956; BINDCLOAK C2 cert.hypersnet[.]com shares an SSL certificate with OctLurk C2 about.blsouqs[.]com; other C2 ssl.blsouqs[.]com and contacts.ftabnews[.]com

Known Targets

Middle East government entities, with the energy vertical a key focus (Zscaler Part 2)Diplomatic sector; lure filenames include "Cooperation protocol for the exploration of petroleum and gas" and "Agreement on the Establishment of Common Border Offices"Primarily Central Asia since early 2025 (Zscaler Part 2); Kaspersky (30 July 2026) reports OctLurk/SilkLurk victims in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria

Analyst Notes

Zscaler's Part 2 (3 August 2026) is published, replacing the earlier "Part 2 pending" note. Kaspersky tracks OctLurk and SilkLurk since January 2025 and assesses with medium confidence a single Chinese-speaking actor, naming no group; that is a separate assessment from Zscaler's "East Asia-linked" and the two are not equated. Kaspersky notes some OctLurk C2 overlap with TrustFall/MystRodX/SilentRaid, which are malware, not a group. Do not merge this cluster with any named APT. ATT&CK IDs T1134.001, T1134.003, T1620, T1057, T1132.002 and T1095 are from Zscaler Part 2; T1027, T1574.002, T1497, T1102.002 and T1480.001 are the site's own mapping (inferred).

Also Known As

Tracked by toolset names TELESHIM, MIXEDKEY, BINDCLOAK — no actor-level alias assigned in current reporting

MITRE ATT&CK Techniques

T1027 Obfuscated Files or Information T1574.002 Hijack Execution Flow: DLL Side-Loading T1497 Virtualization/Sandbox Evasion T1102.002 Web Service: Bidirectional Communication T1620 Reflective Code Loading T1480.001 Execution Guardrails: Environmental Keying T1134.001 Token Impersonation/Theft T1134.003 Make and Impersonate Token T1057 Process Discovery T1132.002 Non-Standard Encoding T1095 Non-Application Layer Protocol

Intelligence Reports

Analysis governmentdiplomatic

TELESHIM, MIXEDKEY, BINDCLOAK: Inside the East Asia APT Campaign Against Middle East Governments

Zscaler ThreatLabz has documented a three-stage malware campaign by an unattributed East Asia-linked actor targeting Middle East government entities. The toolset — TELESHIM, MIXEDKEY, and BINDCLOAK — represents a cluster of previously undocumented malware using Telegram API C2, environmental keying, and DLL sideloading to maintain persistent covert access.

29 Jul 2026 · 12 min read