gbhackers.com · Published 10 Oct
DarkBlinders Hackers Use Fake Meeting App to Deploy Backdoor and Steal Government Data
By Eswar
Excerpt
DarkBlinders hackers are deploying a fake video meeting application and abusing GitHub repositories in a cyberespionage campaign targeting Israel and the Kurdistan Region of Iraq.
Dream researchers observed the operation between August and October 2026. The investigation confirmed compromises affecting a government cloud environment in Kurdistan and a prominent Israeli individual associated with the security sector.
DarkBlinders Hackers Use Fake Meeting App
Recovered operator tasking revealed credential theft and the exfiltration of at least 1 GB of government clo…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by gbhackers.com on gbhackers.com.
Mentioned in the excerpt1
More from gbhackers.com1
gbhackers.com · Web page · Published 7 Oct
Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks
A prolonged Partisan Zmiy intrusion into a medical organization, exposing an updated malware toolkit that combined Telegram command channels, DNS tunneling, and scheduled payload execution. Investigators joined the response in December 2025 and traced the…
On the same topics
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Hermes is a commercial Windows malware platform that combines credential theft with interactive remote access. Advertisements on Russian-language cybercrime forums offer tiered subscriptions. The service has an operator web panel, worker accounts and a…
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
A Python repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path. Following that loader led to Hermes, a subscription service combining credential collection, file access and interactive control of visible and…
K7 Labs · Web page · Published 21 Mar
Volume II: Who aM I? Confessions of an Obfuscated JS Worm
This is volume II of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware Carrying on from where we…
Elastic Security Labs · Web page · Published 26 Mar
The Shelby Strategy
The SHELBY malware family abuses GitHub for command-and-control, stealing data and retrieving commands The attacker’s C2 design has a critical flaw: anyone with the PAT token can control infected machines, exposing a significant security vulnerability Unused…