July 27 desk: TELESHIM Telegram C2, supply chain cooldown

New week. Two items worth flagging at the top: a confirmed East Asia APT active against Middle East governments, and a defensive posture shift from GitHub on supply chain timing.

APT — active campaign

TELESHIM — East Asia APT, Telegram C2, Middle East governments — Zscaler ThreatLabz disclosed 2026-07-27. An East Asia-linked threat actor has compromised government entities across the Middle East and deployed three previously undocumented malware families: TELESHIM (primary implant), MIXEDKEY, and BINDCLOAK (supporting components). Campaign detected earlier in July 2026; specific timeline of initial access not yet public.

C2 channel: Telegram API. Attacker instructions route through the messaging platform rather than attacker-controlled infrastructure or domains on blocklists. Evasion value: outbound Telegram traffic is permitted in most enterprise environments and doesn’t match standard C2 signatures. Application-layer controls are required to selectively block it — most organizations don’t have them in place for Telegram specifically.

Specific country or agency targets: unconfirmed. State attribution beyond “East Asia-linked”: unconfirmed — treat accordingly. Full IOCs: pending the primary ThreatLabz publication. Current disclosure is via secondary reporting; underlying technical indicators are not yet public. Confidence: confirmed campaign, limited detail.

Immediate action if you have Middle East government exposure — contractors, regional offices, supply chain partners: review outbound Telegram API connections from production systems and flag anything that doesn’t map to a known workflow. Pull IOCs from ThreatLabz when the primary report publishes. For related campaign context, see JadeProx / TriBack Loader targeting government entities and ToddyCat OAuth and Gmail C2 infrastructure.

Supply chain — defensive posture

GitHub / PyPI — Dependabot 72-hour cooldown — Announced by GitHub on 2026-07-27. Dependabot will now wait at least three days after a package release before opening a dependency update PR. Coverage extends to PyPI. Rationale: supply chain attacks via dependency managers exploit the gap between a malicious release and community detection — if Dependabot opens a PR immediately, a poisoned version can land in a codebase before registries or downstream tooling have time to flag it. The 72-hour window is intended to close that opening. Configurable via dependabot.yml; repositories with existing cooldown settings retain control over the parameter.

This is a defensive timing change, not a patch. No CVE. The underlying attack class — malicious package releases targeting automated dependency updaters — remains active; this reduces one specific surface without eliminating it. Confidence: confirmed, official GitHub announcement. Sources: The Hacker News, BleepingComputer.

Vulnerabilities — open no-patch windows

Fastjson CVE-2026-16723 (CVSS 9.0) — No 1.x patch as of 2026-07-27. Active exploitation confirmed since 2026-07-25 per ThreatBook and Imperva. Attack surface: Spring Boot applications deserializing untrusted JSON over an externally accessible endpoint. A malicious JSON request executes code without authentication at the privilege level of the Java process. No user interaction required beyond the request reaching the endpoint. Mitigations: migrate to Fastjson 2.x (different deserialization model) or block malicious deserialization at a WAF layer. CVE-2026-16723 meets CISA KEV criteria on current facts — confirmed exploitation, named CVE, no patch; watch CISA’s catalog for an addition. Confidence: confirmed active exploitation, no patch.

GitLab 18.11.3 authenticated RCE — Working PoC public since 2026-07-25 (Yuhang Wu / depthfirst). Any authenticated account on an unpatched self-managed GitLab instance is a remote code execution surface — no admin rights or CI/CD access required. No confirmed fixed build at time of this briefing. Self-managed operators: monitor GitLab security releases and apply on arrival. Confidence: confirmed PoC public, patch window open.

What to watch

1. ThreatLabz primary TELESHIM publication. Full IOCs, specific targets, and technical breakdowns of MIXEDKEY and BINDCLOAK are all pending. When it drops, the threat picture for East Asia APT activity against government and diplomatic targets changes materially.
2. CISA KEV — Fastjson. CVE-2026-16723 satisfies the KEV criteria today. An addition would trigger BOD 22-01 remediation clocks for federal agencies and serve as the prioritization signal for the broader enterprise community.
3. GitLab patch. Working PoC is public; the authenticated RCE surface is open on every unpatched self-managed instance. Time-to-exploit from a working PoC is short.

— airgap