DarkBlinders Targets Israeli Individual and Kurdish Government Cloud
DarkBlinders, an Iran-aligned threat actor, compromised a high-profile individual in Israel and additional targets in a government cloud environment in Iraq’s Kurdistan Region between August and October 2026. Dream Research Labs reported that the activity combined credential phishing with malware delivery, using impersonation and attacker-controlled download sites.
The group has been active since at least September 2024 and has been linked to attacks on aviation infrastructure and telecommunications targets in the United Arab Emirates and Iraq. Researchers say its tooling and infrastructure do not technically overlap with other known hacking groups, although Dream assesses the current activity as part of an operational cluster also associated with UNC5795 and Dust Specter.
Lookalike services support phishing and malware delivery
The latest campaign used domains made to resemble government, webmail and cloud services. Such pages were used either to collect credentials or to present files controlled by the attackers. Dream highlighted examples designed to imitate Outlook Web Access-style and cloud-drive paths.
DarkBlinders also registered decoy brands for a fake videoconferencing application named StarkMeet. Launching the counterfeit application executes ShelbyLoader V2 and then the SHELBYC2 backdoor. The use of both credential-harvesting pages and fake software shows the group varying its delivery methods rather than relying on one lure type.
Loader chain uses sideloading and remote-control backdoor
Earlier reporting by Elastic Security Labs and Group-IB documented attacks that begin with spear-phishing and lead to SHELBYLOADER, also known as HOTAIR. The loader is launched through DLL sideloading and deploys SHELBYC2, also known as AEROSTAT. The backdoor can use GitHub for command-and-control, data exfiltration and remote control. Elastic tracks this cluster as REF8685.
Palo Alto Networks Unit 42 described a related campaign called Blinder Tunnel, identifying the actor as CL-STA-1178. In that operation, attackers impersonated Dubai Airports IT recruiters and sent high-value targets malware-laced coding challenges. A self-contained application imitating a career portal first displayed a questionnaire, a decoy intended to build trust before the next-stage payload arrived as a Microsoft Visual Studio project archive presented as a coding assessment.
The resulting chain used a malicious C# .csproj project to trigger AppDomainManager injection, followed by DLL sideloading to run ShelbyLoader V2 and SHELBYC2. Unit 42 said the attackers used AppDomainManager hijacking to bypass security monitoring mechanisms including Event Tracing for Windows, or ETW. SHELBYC2 also deployed a tunnelling utility called Blackwood.
Related Iran-linked activity broadens the infrastructure picture
Dream cited infrastructure and malware overlaps in connecting DarkBlinders with UNC5795 and Dust Specter. Zscaler documented Dust Specter in March 2026 as a suspected Iran-nexus operation targeting Iraqi government officials while impersonating Iraq’s Ministry of Foreign Affairs. Dream assessed with medium confidence that UNC5795 and UNC5187 may be related sub-clusters within the broader APT34 group.
Separately, Semperis observed the Iranian government-sponsored Prince of Persia, also called Infy, operating a second-stage command-and-control server in the United States in 2026. The server was associated with Tornado, a Tonnerre variant delivered through one-day software vulnerabilities and communicating through HTTPS and the Telegram API. Semperis said the group’s victim count remained low over six months of observed exfiltration activity.
For organisations, the immediate implication is to validate recruiter contacts, software download requests and cloud sign-in pages through independent channels. Identity monitoring, controls for unsigned or unexpected developer-project files, and detection for DLL sideloading can help security teams investigate the delivery paths described in these campaigns.