DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment

AI Summary

Cybersecurity researchers at Dream Research Labs have uncovered a cyber espionage campaign conducted by an Iran-aligned threat actor known as DarkBlinders, targeting Israel and the Kurdistan Region of Iraq between August and October 2026. The group, active since at least September 2024, uses spear-phishing, fake job offers, trojanized coding assessments, and counterfeit software (including a fake videoconferencing app called StarkMeet) to deliver malware, including ShelbyLoader V2 and SHELBYC2, which uses GitHub for command-and-control. The campaign also employs credential phishing via lookalike government and cloud-service domains. DarkBlinders is assessed with medium confidence to be linked to other Iran-nexus clusters, including Dust Specter, with shared targets in Iraqi government entities and possible ties to APT34. Separately, another Iranian threat group, Prince of Persia, was found operating a C2 server on U.S. soil for the first time in a decade, coinciding with tensions between Iran and the United States.