DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment Ravie LakshmananNov 02, 2026Cyber Espionage / Cyber Attack Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud environment in the Kurdistan Region. The activity has been attributed to a threat actor known as DarkBlinders, an Iran-nexus group assessed to be active since at least September 2024 and linked to attacks aimed at aviation infrastructure and telecommunications in the U.A.E. and Iraq. It exhibits no technical overlap with other known hacking groups. Attacks mounted by the group are known to rely on spear-phishing as an initial access pathway to lure recipients into opening trojanized utilities or clicking on attacker-controlled websites that host similar tools as direct downloads. Previous attack chains documented by Elastic Security Labs and Group-IB have led to the deployment of SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT) that uses GitHub for command-and-control (C2), data exfiltration, and remote control. Elastic is tracking the threat cluster under the moniker REF8685. Then early last month, Palo Alto Networks shed light on a campaign dubbed Blinder Tunnel in which the threat actor, which it calls CL-STA-1178, was observed masquerading as the Dubai Airports IT department to distribute malware-laced coding challenges to high-value targets. The bogus recruitment scheme was first detected in late March 2026, although evidence indicates that the attackers were staging and testing attack infrastructure as far back as November 2025. The social engineering campaign is assessed to have approached specific targets with lucrative job offers to trick them into executing a self-contained application that mimicked a career portal and instructed them to complete a questionnaire. Submitting the questionnaire does not cause any data to be exfiltrated or initiate any response from an external domain. Instead, it's meant to serve as a harmless decoy and build credibility before delivering the next stage payload containing the malware in the form of a Microsoft Visual Studio project archive that's dressed up as a coding assessment. The attack chain makes use of three techniques to establish persistent access: A malicious C# project ".csproj" file is used to trigger AppDomainManager injection, followed by DLL sideloading to deliver an updated version of SHELBYLOADER (aka ShelbyLoader V2), which then launches SHELBYC2. Also deployed via SHELBYC2 is a tunneling utility called Blackwood. "The attackers behind the activity used tailored social engineering techniques to masquerade as Dubai Airports recruiters, using a trojanized Visual Studio coding challenge to target a high-value job seeker based in Iraq," Unit 42 said. "The campaign is characterized by misuse of built-in developer tools and DLL sideloading. Attackers also used AppDomainManager hijacking to bypass security monitors like ETW [Event Tracing for Windows]." The latest findings from Dream show that the threat actor continues to rely on social engineering, while combining both credential phishing and malware delivery. This involves the use of government, webmail, and cloud-service lookalike domains to collect credentials or present attacker-controlled file downloads. Some of the highlighted domains include - moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O The threat actor has also been observed setting decoy brand domains for a fake videoconferencing application called StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website). Installing and launching the app leads to the execution of ShelbyLoader V2 and SHELBYC2. The development is also a sign that the threat actor is trying out different methods for malware delivery, ranging from coding assessments to counterfeit software. Dream said the DarkBlinders activity belongs to the same operational cluster as UNC5795 and Dust Specter, citing infrastructure and malware overlaps. Dust Specter, documented by Zscaler in March 2026, refers to a suspected Iran-nexus operation targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs. "Historical server fingerprints, overlapping victimology, and supporting attribution research lead us to assess with medium confidence that UNC5795 and UNC5187 may represent related sub-clusters within the broader APT34 group," it added. "Their overlapping focus on Iraqi government entities adds context to this technical connection and suggests a shared intelligence collection interest. Combined with their respective APT34 associations, these findings support a medium-confidence assessment that the two clusters are operationally related and may belong to the same broader group." Prince of Persia Hosts C2 in the U.S. for the First Time in a Decade The disclosure comes as Prince of Persia (aka Infy), a lesser-known threat group sponsored by the Iranian government, has been observed running one of its C2 servers ("68.65.122[.]203") from the U.S. this year. The server was likely built in July 2026. The infrastructure is a second-stage C2 server associated with Tornado, a Tonnerre variant that's dropped via one-day software vulnerabilities and uses both HTTPS and the Telegram API for C2. The emergence of new C2 servers in late May 2026 follows three months of inactivity, which has been described as the "longest downtime in nearly two decades of activity by the threat actor." "We have been monitoring Prince of Persia's exfiltration activity for the past six months," Tomer Bar, associate vice president of security research at Semperis, said. "The number of victims remains low, which could indicate either targeted attacks or difficulties infecting new victims." "The Iranian threat actor decided to host its new C2 server on U.S. soil — at the same time as the beginning of the recent hostilities between Iran and the United States. This is the last place we expected to find the threat actor hiding." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cloud security, Cyber Attack, cyber espionage, Malware, Nation-State, Phishing, Social Engineering PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software AI-Generated Fake Login Pages Are Making Account Takeovers Easier Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security