DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment

Cybersecurity researchers have disclosed a cyber espionage campaign by an Iran state-aligned threat actor targeting Israel and the Kurdistan Region of Iraq between August and October 2026. According to Dream Research Labs, the activity compromised a high-profile individual in Israel and also affected a government cloud environment in the Kurdistan Region. The campaign has been attributed to DarkBlinders, a group assessed to be active since at least September 2024.

Attribution and targeting

Dream Research Labs attributed the campaign to DarkBlinders, an Iran-nexus group linked to attacks on aviation infrastructure and telecommunications in the United Arab Emirates and Iraq. The report said the group exhibits no technical overlap with other known hacking groups. The latest findings indicate that DarkBlinders continues to use social engineering while combining credential phishing with malware delivery.

Social engineering and malware delivery

Previous attack chains documented by Elastic Security Labs and Group-IB led to SHELBYLOADER, also known as HOTAIR, which is launched through DLL sideloading to execute a backdoor called SHELBYC2, also known as AEROSTAT. SHELBYC2 uses GitHub for command-and-control, data exfiltration, and remote control, and Elastic tracks the cluster as REF8685. Palo Alto Networks also described a campaign called Blinder Tunnel in which the actor it calls CL-STA-1178 masqueraded as the Dubai Airports IT department to distribute malware-laced coding challenges to high-value targets. The bogus recruitment scheme was first detected in late March 2026, while evidence indicates the attackers were staging and testing infrastructure as far back as November 2025.

The social engineering campaign approached specific targets with job offers and tricked them into running an application that mimicked a career portal and asked them to complete a questionnaire. The questionnaire served as a harmless decoy to build credibility before delivering a Microsoft Visual Studio project archive dressed up as a coding assessment. The attack chain used a malicious C# .csproj file to trigger AppDomainManager injection, followed by DLL sideloading to deliver an updated ShelbyLoader V2, which then launched SHELBYC2. SHELBYC2 also deployed a tunneling utility called Blackwood.

Phishing domains and fake software

Dream reported that the threat actor used government, webmail, and cloud-service lookalike domains to collect credentials or present attacker-controlled file downloads. The highlighted domains included gcc-sg[.]cloud/owa/auth/logon.aspx, mfakuwait[.]online/owa/auth/logon.aspx, and moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O. The actor also set up decoy brand domains for a fake videoconferencing application called StarkMeet at stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website. Installing and launching the app leads to execution of ShelbyLoader V2 and SHELBYC2, according to the report.

Operational links

Dream said DarkBlinders belongs to the same operational cluster as UNC5795 and Dust Specter, citing infrastructure and malware overlaps. Dust Specter, documented by Zscaler in March 2026, refers to a suspected Iran-nexus operation targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs. The report assessed with medium confidence that UNC5795 and UNC5187 may represent related sub-clusters within the broader APT34 group, adding that their overlapping focus on Iraqi government entities suggests a shared intelligence collection interest.

Sources: The Hacker News