Iran-nexus DarkBlinders breaches Israeli target and Iraqi Kurdish government cloud

An Iran-nexus threat actor that researchers call DarkBlinders carried out an espionage campaign against targets in Israel and the Kurdistan Region of Iraq, compromising a high-profile individual and a government cloud environment, according to a report by Dream Research Labs covered by The Hacker News.

What happened

Dream Research Labs assesses that DarkBlinders has been active since at least September 2024 and has previously been linked to attacks on aviation infrastructure and telecommunications in the UAE and Iraq, The Hacker News reported. Between August and October 2026, the group's campaign targeted Israel and the Kurdistan Region of Iraq, compromising a high-profile individual in Israel and affecting a government cloud environment in the Kurdistan Region. Dream says the actor shows no technical overlap with other known hacking groups, though it ties the activity to a wider operational cluster.

Technical details

According to Dream, initial access typically came through spear-phishing that lured victims into running trojanized utilities or downloading tools from attacker-controlled websites. Earlier infection chains documented by Elastic and Group-IB deployed a loader called SHELBYLOADER (also known as HOTAIR) via DLL sideloading, which in turn launched the SHELBYC2 (AEROSTAT) backdoor that used GitHub for command-and-control. Dream also observed lookalike government, webmail, and cloud-service domains used to harvest credentials or host malicious downloads, as well as a fake videoconferencing app named "StarkMeet" whose launch executed ShelbyLoader V2 and SHELBYC2.

The Hacker News notes a related operation reported by Palo Alto Networks' Unit 42 as "Blinder Tunnel" (tracked as CL-STA-1178), in which attackers posed as Dubai Airports recruiters and used a trojanized Visual Studio coding challenge. That chain relied on a malicious .csproj file for AppDomainManager injection and DLL sideloading to deliver ShelbyLoader V2, and used AppDomainManager hijacking to bypass ETW monitoring, alongside a tunneling tool called Blackwood.

Attribution

Dream says the DarkBlinders activity belongs to the same operational cluster as UNC5795 and Dust Specter, citing infrastructure and malware overlaps. It assesses with medium confidence that UNC5795 and UNC5187 may be related sub-clusters within the broader APT34 group. Dust Specter was documented by Zscaler in March 2026 as an Iran-nexus operation targeting Iraqi government officials. These attributions are the researchers' assessments and, as with all such clustering, carry inherent uncertainty.

What to do

Organizations in the targeted regions and sectors should treat unsolicited job offers, coding challenges, and software downloads delivered through messaging or lookalike domains with caution. Defenders can watch for DLL sideloading, AppDomainManager injection, and suspicious outbound connections to GitHub-based command-and-control, and should scrutinize credential-harvesting pages that imitate government and webmail portals. Verifying the authenticity of videoconferencing and recruiter tools through official channels before running them reduces exposure to this class of social-engineering access.