DarkBlinders Cyber Espionage Targets Israel and Iraqi Kurdistan Government
State-aligned threat actor utilizes sophisticated social engineering and DLL sideloading to compromise cloud environments.
1Targeted Espionage Campaign Identified
Between August and October 2026, the Iran-aligned group DarkBlinders executed a targeted cyber espionage campaign. The operation successfully compromised a high-profile individual in Israel and infiltrated a government cloud environment within the Kurdistan Region of Iraq. This activity marks a significant escalation in regional digital intelligence gathering operations by the group.
2Sophisticated Initial Access Pathways
DarkBlinders relies heavily on spear-phishing to initiate attacks, often masquerading as legitimate entities. The group lures victims into downloading trojanized utilities or visiting attacker-controlled websites. These deceptive tactics are designed to build initial credibility before the final payload delivery, ensuring the target remains unaware of the malicious intent during the interaction.
3Technical Execution and Persistence
The attack chain utilizes AppDomainManager injection and DLL sideloading to deploy the updated SHELBYLOADER V2. This loader subsequently executes the SHELBYC2 backdoor, which leverages GitHub for command-and-control communications. Additionally, the group deploys a tunneling utility called Blackwood to maintain persistent access and facilitate data exfiltration from the compromised government cloud infrastructure.
4Deceptive Recruitment and Decoy Tactics
The threat actor previously masqueraded as Dubai Airports IT recruiters to distribute malware-laced coding challenges. Targets were tricked into executing a Visual Studio project archive disguised as a professional assessment. This decoy method effectively bypassed security monitors, allowing the attackers to establish a foothold while appearing to conduct a standard recruitment process.
5Infrastructure and Operational Overlaps
Research links DarkBlinders to broader operational clusters, including UNC5795 and the Dust Specter group. These entities share infrastructure fingerprints and victimology patterns, specifically targeting Iraqi government officials. Analysts assess with medium confidence that these clusters represent related sub-clusters within the broader APT34 group, suggesting a unified intelligence collection strategy across the region.
6Evolution of Malware Delivery Methods
Beyond coding assessments, the group has diversified its delivery mechanisms by creating decoy brand domains for a fake videoconferencing application named StarkMeet. Installing this counterfeit software triggers the execution of both ShelbyLoader V2 and SHELBYC2. This shift indicates an ongoing effort to experiment with various software-based lures to maintain operational success.
7Prince of Persia C2 Activity
Simultaneously, the Iranian-sponsored group Prince of Persia established a second-stage C2 server on U.S. soil in July 2026. This infrastructure supports the Tornado variant, which utilizes HTTPS and the Telegram API for command-and-control. Despite nearly two decades of activity, the group has experienced its longest period of downtime recently, followed by this unusual hosting.
8Strategic Implications for Security Operations
The persistent use of built-in developer tools and AppDomainManager hijacking highlights critical gaps in identity visibility and endpoint security. Organizations must prioritize strengthening attack surface visibility and preparing security operations for these emerging, state-aligned threats. Monitoring for unusual GitHub traffic and unauthorized DLL sideloading remains essential for detecting these sophisticated espionage campaigns.