Dream Reports DarkBlinders Espionage Campaign Targeting Israel and Iraqi Kurdistan
Summary
Dream Research Labs reports DarkBlinders activity targeting Israel and Iraqi Kurdistan from August to October 2026, including reported compromises of a high-profile Israeli individual and a regional government cloud environment.
Key points
- Dream Research Labs attributes the campaign to DarkBlinders, described as an Iran-aligned threat actor.
- The report says the activity resulted in the compromise of a high-profile individual in Israel and additional compromises in a government cloud environment in the Kurdistan Region of Iraq.
- The campaign combines credential phishing with malware delivery through lookalike government, webmail and cloud-service domains, as well as a fake videoconferencing app.
- A fake recruitment process uses a questionnaire as a decoy before delivering a trojanized Visual Studio coding assessment.
- The described attack chain uses a malicious C# project for AppDomainManager injection, DLL sideloading to deliver SHELBYLOADER V2, and SHELBYC2; Blackwood is also deployed.
- Dream links the activity to UNC5795 and Dust Specter based on infrastructure and malware overlap; it assesses possible links among UNC5795, UNC5187 and APT34 with medium confidence.
Article Details
- Event Type
- Cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq, attributed to DarkBlinders.
- Impact
- The campaign reportedly compromised a high-profile individual in Israel and affected a government cloud environment in the Kurdistan Region of Iraq. Reported methods include credential phishing and malware delivery. The article does not specify the extent of data loss from these compromises.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | stark-meet[.]com | A decoy brand domain set up by the threat actor for the fake StarkMeet application; launching the application leads to malware execution. |
| DOMAIN | stark-meet[.]online | A decoy brand domain set up by the threat actor for the fake StarkMeet application; launching the application leads to malware execution. |
| DOMAIN | stark-meet[.]website | A decoy brand domain set up by the threat actor for the fake StarkMeet application; launching the application leads to malware execution. |
| IPV4 | 68[.]65[.]122[.]203 | A second-stage C2 server associated with Prince of Persia and the Tornado malware; the article says it was likely built in July 2026. |
MITRE ATT&CK
T1566.002 · Spearphishing LinkThe article describes spear-phishing that lures targets to attacker-controlled websites hosting tool downloads.T1574.002 · DLL Side-LoadingThe article explicitly describes DLL sideloading to deliver SHELBYLOADER and launch SHELBYC2.T1574.014 · AppDomainManagerA malicious C# project file is described as triggering AppDomainManager injection.
People
Threat Actors
CL-STA-1178Palo Alto Networks' designation for the threat actor observed in the Blinder Tunnel campaign, which used a fake Dubai Airports recruitment scheme to deliver malware.DarkBlindersThe campaign targeting Israel and the Kurdistan Region of Iraq is attributed to this Iran-aligned threat actor. The article describes social engineering, credential phishing, and malware delivery.Dust SpecterDream Research Labs assessed that the DarkBlinders activity belongs to the same operational cluster as Dust Specter, described as a suspected Iran-nexus operation targeting Iraqi government officials.InfyThe article identifies Infy as another name for Prince of Persia, a threat group reported to have operated a C2 server associated with Tornado.Prince of PersiaAn Iranian government-sponsored threat group reported to have operated a C2 server associated with Tornado. The article states that Prince of Persia is also known as Infy.REF8685Elastic's tracking name for the threat cluster associated in the article with prior attacks deploying SHELBYLOADER and SHELBYC2.SOLAR IONThe article reports a medium-confidence assessment connecting UNC5795 and UNC5187 to the broader APT34 group.UNC5187The article reports a medium-confidence assessment that UNC5187 and UNC5795 may be related sub-clusters within the broader APT34 group.UNC5795Dream Research Labs assessed that the DarkBlinders activity belongs to the same operational cluster as UNC5795; the article also reports a medium-confidence assessment that it may be related to UNC5187.
Malware
AEROSTATHOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT) that uses GitHub for command-and-control (C2), data exfiltration, and remote control. Elastic isHOTAIRchains documented by Elastic Security Labs and Group-IB have led to the deployment of SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT)ShelbyC2SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT) that uses GitHub for command-and-control (C2), data exfiltration, and remote control.ShelbyLoaderPrevious attack chains documented by Elastic Security Labs and Group-IB have led to the deployment of SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2ShelbyLoader V2injection, followed by DLL sideloading to deliver an updated version of SHELBYLOADER (aka ShelbyLoader V2), which then launches SHELBYC2. Also deployed via SHELBYC2 is a tunneling utility called Blackwood.TonnerreThe infrastructure is a second-stage C2 server associated with Tornado, a Tonnerre variant that's dropped via one-day software vulnerabilities and uses both HTTPS and the Telegram API for C2. The emergence of new C2TornadoThe infrastructure is a second-stage C2 server associated with Tornado, a Tonnerre variant that's dropped via one-day software vulnerabilities and uses both HTTPS and the Telegram API for C2. The emergence of new C2
Products
Microsoft Visual Studiocredibility before delivering the next stage payload containing the malware in the form of a Microsoft Visual Studio project archive that's dressed up as a coding assessment.StarkMeethas also been observed setting decoy brand domains for a fake videoconferencing application called StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website). Installing and launching the app
Tools
Countries
IranCybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.IraqCybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.IsraelCybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.U.A.E.least September 2024 and linked to attacks aimed at aviation infrastructure and telecommunications in the U.A.E. and Iraq. It exhibits no technical overlap with other known hacking groups.United Statesby the Iranian government, has been observed running one of its C2 servers ("68.65.122[.]203") from the U.S. this year. The server was likely built in July 2026.
Industries
Aviationan Iran-nexus group assessed to be active since at least September 2024 and linked to attacks aimed at aviation infrastructure and telecommunications in the U.A.E. and Iraq. It exhibits no technical overlap withGovernmentto the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud environment in the Kurdistan Region.Telecommunicationsbe active since at least September 2024 and linked to attacks aimed at aviation infrastructure and telecommunications in the U.A.E. and Iraq. It exhibits no technical overlap with other known hacking groups.