DarkBlinders targets Israeli and Iraqi Kurdish government systems

Cybersecurity researchers have disclosed a state‑aligned Iranian threat group operation, DarkBlinders, targeting an Israeli individual and a Kurdistan Region government cloud environment between August and October 2026. The disclosures, highlighted in a Dream Research Labs report, tie the activity to Iran‑nexus operators active since at least September 2024, with prior campaigns against aviation and telecom sectors in the region.

Dream Research Labs and Unit 42 of Palo Alto Networks describe a campaign employing spear‑phishing and trojanised tooling to gain initial access, followed by a sequence including AppDomainManager injection, DLL sideloading, and the deployment of an updated ShelbyLoader (aka ShelbyLoader V2) which yields the backdoor SHELBYC2 (aka AEROSTAT) and a tunnelling utility named Blackwood.

SHELBYLOADER and SHELBYC2 have previously been linked to GitHub as a C2, data exfiltration and remote‑control channel, with Elastic Security Labs and Group‑IB noting overlaps with clusters tracked as REF8685.

The report cites targeted social engineering masquerading as Dubai Airports IT recruiters to reach a high‑value Iraqi target, using decoy job offers and a trojanised Visual Studio coding challenge. The campaign combines credential phishing with malware delivery through lookalike government, webmail and cloud domains, such as gcc-sg[.]cloud/owa/auth/logon.aspx and mfakuwait[.]online/owa/auth/logon.aspx, and decoy brands including StarkMeet for a fake videoconferencing app.

Dream links the DarkBlinders activity with related clusters such as UNC5795 and Dust Specter, suggesting shared exploitation interests in Iraqi government entities; attribution notes a medium‑confidence view that these clusters may be related under the broader APT34 umbrella. The piece also notes Prince of Persia activity (Infy) hosting a C2 server on U.S. soil, but this is presented as a separate finding.