Malware
ShelbyLoader
- First Reported
- Oct 6, 2026
- Latest Reported
- Nov 2, 2026
Reported Context (2)
- Previous attack chains documented by Elastic Security Labs and Group-IB have led to the deployment of SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 Dream Reports DarkBlinders Espionage Campaign Targeting Israel and Iraqi Kurdistan
- These steps enabled the attackers to deploy custom malware that we refer to as ShelbyLoader V2. Iranian-Aligned Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure
Malware (9)
People (1)
Threat Actors (9)
MITRE ATT&CK (14)
Vendors (5)
Products (15)
Tools (4)
Industries (4)
Countries (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.