Iran-Aligned DarkBlinders Targets Israel and Iraqi Kurdistan with Sophisticated Phishing and Malware
An Iran-nexus threat actor, DarkBlinders, has been linked to a cyber espionage campaign targeting high-profile individuals in Israel and government cloud environments in the Kurdistan Region of Iraq, employing advanced social engineering and custom malware.
A recent cybersecurity report has detailed a sophisticated cyber espionage campaign orchestrated by the Iran-aligned threat actor known as DarkBlinders. The campaign, active between August and October 2026, specifically targeted a high-profile individual in Israel and compromised a government cloud environment within the Kurdistan Region of Iraq. This operation highlights the persistent threat posed by nation-state actors in the Middle East.
DarkBlinders, assessed to be active since at least September 2024, has previously been linked to attacks against aviation and telecommunications sectors in the UAE and Iraq. The group's operational methods are distinct, showing no technical overlap with other known hacking collectives. Their primary initial access vector relies on spear-phishing, aiming to trick recipients into opening trojanized utilities or visiting malicious websites that offer similar tools for download.
Previous analyses by Elastic Security Labs and Group-IB have documented attack chains involving the deployment of SHELBYLOADER, also known as HOTAIR. This malware is deployed using DLL sideloading and ultimately executes a backdoor named SHELBYC2 (or AEROSTAT), which leverages GitHub for command-and-control (C2) communications, data exfiltration, and remote control of compromised systems. Elastic tracks this threat cluster under the designation REF8685.
More recently, Palo Alto Networks identified a campaign dubbed "Blinder Tunnel," where the threat actor, identified as CL-STA-1178, impersonated the Dubai Airports IT department. This campaign distributed malware disguised as coding challenges to high-value targets. The social engineering scheme involved enticing specific individuals with lucrative job offers, leading them to execute a self-contained application mimicking a career portal. This decoy application built credibility before delivering the main payload.
The attack chain employed in the "Blinder Tunnel" campaign is particularly intricate. It utilizes a malicious C# project file (.csproj) to initiate AppDomainManager injection, followed by DLL sideloading to deploy an updated version of SHELBYLOADER (ShelbyLoader V2). This, in turn, launches SHELBYC2, which also facilitates the deployment of a tunneling utility named Blackwood. The attackers also employed AppDomainManager hijacking to evade security monitoring tools like Event Tracing for Windows (ETW).
Recent findings indicate that DarkBlinders continues to refine its tactics, combining credential phishing with malware delivery. They are observed using lookalike domains for government, webmail, and cloud services to harvest credentials or trick users into downloading malicious files. Examples of such domains include "gcc-sg[.]cloud/owa/auth/logon.aspx" and "mfakuwait[.]online/owa/auth/logon.aspx." The group has also created decoy domains for a fake videoconferencing application, StarkMeet, which, upon installation, executes ShelbyLoader V2 and SHELBYC2.
Dream Research Labs suggests that DarkBlinders' activities align with operational clusters attributed to UNC5795 and Dust Specter, citing overlapping infrastructure and malware. Dust Specter, previously documented, is a suspected Iran-nexus operation targeting Iraqi government officials by impersonating the country's Ministry of Foreign Affairs. The shared focus on Iraqi government entities and potential links to the broader APT34 group suggest a coordinated intelligence-gathering effort by Iran-backed actors.
This campaign underscores the evolving sophistication of Iran-nexus threat actors in conducting targeted cyber espionage. The use of tailored social engineering, advanced malware delivery techniques, and the exploitation of trusted platforms like GitHub and Visual Studio demonstrate a persistent and adaptive threat landscape, particularly concerning for entities in the Middle East.