Dark Blinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
Summary: Dream Research Labs reported an Iran-aligned group called DarkBlinders ran a cyber espionage campaign against Israel and the Kurdistan Region of Iraq between August and October 2026, compromising a high-profile individual in Israel and a government cloud environment in Kurdistan. The group, active since at least September 2024 and linked to attacks on aviation and telecommunications in the U.A.E. and Iraq, uses spear-phishing, lookalike government and cloud-service domains, and a fake videoconferencing app called StarkMeet to deliver ShelbyLoader V2 and SHELBYC2.
Bottom line: A government cloud environment in the Kurdistan Region was compromised, and Dream assesses with medium confidence that DarkBlinders overlaps operationally with UNC5795 and Dust Specter, clusters tied to the broader APT34 group with a shared focus on Iraqi government entities.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026