A sophisticated threat actor, known as TELESHIM, has been exploiting Telegram’s built-in features to establish command and control (C2) channels for malicious activities targeting governments in the Middle East. The alarming trend reveals the growing reliance of cyber attackers on social media platforms to launch attacks.
TELESHIM’s tactics involve leveraging Telegram’s “secret chats” feature, which is designed to provide secure communication between users. By creating fake user profiles and engaging with real users, TELESHIM gains access to their contact lists, ultimately enabling them to send targeted messages and attachments that contain malicious payloads. Once the payload is delivered, TELESHIM can establish a C2 channel, granting them control over compromised systems.
The Middle East governments have been among the primary targets of these attacks. TELESHIM’s ability to blend in seamlessly with Telegram’s user base has made it challenging for security teams to detect their activities. The threat actor’s tactics also demonstrate an understanding of the platform’s vulnerabilities and how to exploit them for malicious gain. By establishing a foothold within an organization, TELESHIM can launch subsequent attacks or compromise sensitive information.
This latest development serves as a stark reminder that even well-intentioned features in popular social media platforms can be exploited by threat actors. Telegram’s “secret chats” feature, designed to protect user privacy, has become a tool for malicious activities. As users increasingly rely on social media for communication and collaboration, the risk of these platforms being used for nefarious purposes grows.
The implications of this trend are far-reaching. Governments and organizations in the Middle East have been left scrambling to mitigate the damage caused by TELESHIM’s attacks. Meanwhile, cybersecurity professionals worldwide should take heed of this development, recognizing that social media platforms can be vulnerable to exploitation by sophisticated threat actors. As AI-powered tools become increasingly prevalent in cybersecurity, it is essential for users to remain vigilant and adapt their security measures accordingly.
To secure against software vulnerabilities discovered by AI models, organizations must prioritize continuous monitoring and patching of systems. Furthermore, implementing robust incident response plans will enable teams to quickly respond to and contain potential breaches. Users should also be cautious when engaging with unknown profiles or attachments from unverified sources, as these can often serve as entry points for malicious activities. By staying informed and taking proactive steps to secure their digital presence, individuals and organizations can minimize the risk of falling prey to TELESHIM’s tactics.
Source: The Hacker News — 2026-07-27