Cybersecurity researchers have disclosed a cyber-espionage campaign attributed to DarkBlinders, an Iran-nexus threat actor active since at least September 2024. The operation targeted Israel and the Kurdistan Region of Iraq between August and October 2026, according to a report from Dream Research Labs.
The campaign resulted in the compromise of a high-profile individual in Israel, as well as additional compromises involving a government cloud environment in the Kurdistan Region. DarkBlinders has previously been associated with attacks against aviation infrastructure and telecommunications in the United Arab Emirates and Iraq, although researchers found no technical overlap with other known hacking groups.
The group typically uses spear-phishing to persuade victims to open trojanized utilities or visit attacker-controlled websites offering similar tools for download. Earlier campaigns documented by Elastic Security Labs and Group-IB involved SHELBYLOADER, also known as HOTAIR, which was delivered through DLL sideloading and used to launch the SHELBYC2 backdoor, also called AEROSTAT. The malware relies on GitHub for command and control, data exfiltration and remote control. Elastic tracks the cluster as REF8685.
Dream’s latest findings indicate that DarkBlinders continues to combine social engineering with credential theft and malware delivery. The operation used government, webmail and cloud-service lookalike domains to collect credentials or distribute attacker-controlled files. Researchers also identified domains associated with StarkMeet, a fake videoconferencing application. Installing and launching the application triggered SHELBYLOADER V2 and SHELBYC2.
The activity follows a campaign described by Palo Alto Networks as Blinder Tunnel. In that operation, the threat actor, tracked by the company as CL-STA-1178, impersonated the Dubai Airports IT department and sent malware-laced coding challenges to high-value targets.
The fake recruitment operation used attractive job offers to persuade selected victims to run an application resembling a career portal and complete a questionnaire. The questionnaire acted as a decoy, with no immediate data exfiltration or external response. The next stage was concealed in a Microsoft Visual Studio project archive presented as a coding assessment.
The attack chain used a malicious C# project file to trigger AppDomainManager injection, followed by DLL sideloading to deliver SHELBYLOADER V2 and launch SHELBYC2. The backdoor could also deploy Blackwood, a tunneling tool. Unit 42 said the campaign used tailored social engineering and abused developer tools, while AppDomainManager hijacking was used to bypass security monitoring mechanisms such as Event Tracing for Windows.
Dream assessed that the DarkBlinders activity belongs to the same operational cluster as UNC5795 and Dust Specter, based on infrastructure and malware overlaps. Dust Specter was documented by Zscaler in March 2026 in connection with an operation targeting Iraqi government officials through impersonation of Iraq’s Ministry of Foreign Affairs.
The researchers said historical server fingerprints, overlapping victimology and other attribution findings support, with medium confidence, the possibility that UNC5795 and UNC5187 are related sub-clusters within the broader APT34 group. Their shared focus on Iraqi government entities was cited as evidence of a potentially common intelligence-collection interest.
Sources: The Hacker News.