Malware
ShelbyC2
- First Reported
- Oct 6, 2026
- Latest Reported
- Nov 2, 2026
Reported Context (2)
- SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT) that uses GitHub for command-and-control (C2), data exfiltration, and remote control. Dream Reports DarkBlinders Espionage Campaign Targeting Israel and Iraqi Kurdistan
- ShelbyC2 V2: Primary backdoor Iranian-Aligned Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure
Malware (9)
People (1)
Threat Actors (9)
MITRE ATT&CK (14)
Vendors (5)
Products (15)
Tools (4)
Industries (4)
Countries (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.