Iran-Linked DarkBlinders Targets Israel and Iraqi Kurdistan in Espionage Campaign
Cybersecurity researchers have uncovered an espionage campaign targeting Israel and the Kurdistan Region of Iraq between August and October 2026. The activity has been attributed to DarkBlinders, an Iran-aligned threat actor using targeted social engineering, credential phishing and malware delivery to compromise high-value individuals and government environments.
According to research published by Dream Research Labs, the campaign resulted in the compromise of a high-profile individual in Israel and additional intrusions into a government cloud environment in the Kurdistan Region.
DarkBlinders is assessed to have been active since at least September 2024. Previous operations linked to the group targeted aviation infrastructure and telecommunications organizations in the United Arab Emirates and Iraq. Researchers have not identified technical overlap between DarkBlinders and other known hacking groups.
Spear-Phishing and Malware Delivery Tactics
DarkBlinders typically relies on spear-phishing to gain initial access. Attackers persuade targets to open trojanized utilities or visit malicious websites hosting downloadable tools.
Earlier campaigns documented by Elastic Security Labs and Group-IB involved SHELBYLOADER, also known as HOTAIR. The malware is delivered through DLL sideloading and ultimately deploys a backdoor called SHELBYC2, also known as AEROSTAT.
SHELBYC2 uses GitHub for command-and-control (C2), data exfiltration and remote access. Elastic tracks the associated activity under the designation REF8685.
Fake Dubai Airports Recruitment Campaign
In September 2026, Palo Alto Networks' Unit 42 disclosed a related operation called Blinder Tunnel, in which attackers impersonated the IT department of Dubai Airports to distribute malicious coding challenges to high-value targets.
The recruitment-themed campaign was initially detected in late March 2026, although evidence suggested that attackers had been preparing and testing their infrastructure as early as November 2025.
The attackers approached selected individuals with attractive job opportunities and encouraged them to run a self-contained application designed to resemble a recruitment portal. The application presented a questionnaire intended to make the process appear legitimate.
Submitting the questionnaire did not trigger data exfiltration or communication with an external domain. Instead, it acted as a harmless decoy to establish trust before the next stage of the attack.
Victims were subsequently encouraged to download a Microsoft Visual Studio project archive disguised as a coding assessment.
The attack chain used several techniques to establish persistent access:
- A malicious C# project file (
.csproj) triggered AppDomainManager injection. - DLL sideloading delivered an updated version of SHELBYLOADER, known as ShelbyLoader V2.
- ShelbyLoader V2 launched the SHELBYC2 backdoor.
- SHELBYC2 was also used to deploy a tunneling utility called Blackwood.
Unit 42 reported that the attackers used developer tools and DLL sideloading as part of the infection process. AppDomainManager hijacking was also used to evade security monitoring mechanisms such as Event Tracing for Windows (ETW).
Credential Phishing and Fake Software
Dream Research Labs' latest findings indicate that DarkBlinders continues to combine social engineering with credential theft and malware distribution.
The group has used lookalike domains impersonating government services, webmail platforms and cloud storage providers to collect credentials or deliver malicious downloads.
Some identified domains include:
gcc-sg[.]cloud/owa/auth/logon.aspxmfakuwait[.]online/owa/auth/logon.aspxmoelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O
Researchers also identified infrastructure associated with a fake videoconferencing application called StarkMeet. The campaign used the following domains:
stark-meet[.]comstark-meet[.]onlinestark-meet[.]website
Installing and launching the counterfeit application results in the execution of ShelbyLoader V2 and SHELBYC2.
The use of fake recruitment portals, coding assessments and counterfeit software demonstrates the group's expanding range of malware delivery techniques.
Possible Connections to UNC5795, UNC5187 and APT34
Dream Research Labs assessed that DarkBlinders belongs to the same broader operational cluster as UNC5795 and Dust Specter, citing infrastructure similarities and overlapping malware activity.
Dust Specter was documented by Zscaler in March 2026 as a suspected Iran-linked operation targeting Iraqi government officials. The attackers reportedly impersonated Iraq's Ministry of Foreign Affairs to approach their targets.
Dream also identified historical server fingerprints, overlapping victimology and supporting attribution research that may connect UNC5795 and UNC5187.
Researchers assessed with medium confidence that these two clusters could represent related subgroups within the broader APT34 threat group.
Their shared interest in Iraqi government organizations provides additional context for the suspected relationship, although the attribution remains an assessment rather than a confirmed connection.
Prince of Persia Operates a C2 Server in the United States
Separately, researchers have observed another Iran-linked threat actor, Prince of Persia, also known as Infy, operating a command-and-control server hosted in the United States for the first time in approximately a decade.
The server, identified as 68.65.122[.]203, was likely established in July 2026 and is associated with the second-stage C2 infrastructure used by the group's Tornado malware.
Tornado is a variant of Tonnerre that is delivered through recently disclosed software vulnerabilities. It uses both HTTPS and the Telegram API for command-and-control communications.
New C2 infrastructure began appearing in late May 2026 after approximately three months of inactivity. Researchers described this pause as the longest period of downtime in nearly two decades of the group's activity.
Semperis reported monitoring Prince of Persia's data-exfiltration activity over a six-month period. The number of identified victims remained relatively low, potentially indicating highly targeted operations or difficulties compromising new systems.
The decision to host a C2 server on U.S. infrastructure is particularly notable given the timing of renewed hostilities between Iran and the United States.
Growing Iranian Cyber Espionage Activity
The DarkBlinders campaign highlights how Iran-aligned threat actors continue to use carefully tailored social engineering to compromise high-value targets.
By combining fake recruitment campaigns, malicious developer projects, credential-harvesting websites and counterfeit applications, attackers can exploit professional trust while delivering sophisticated malware.
The reported activity also demonstrates the importance of monitoring suspicious Visual Studio projects, verifying recruitment communications, checking software download sources and protecting cloud credentials against phishing attacks.
