{"id":3924,"date":"2026-11-02T15:24:55","date_gmt":"2026-11-02T15:24:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3924"},"modified":"2026-11-02T15:24:55","modified_gmt":"2026-11-02T15:24:55","slug":"darkblinders-compromises-israeli-target-and-iraqi-kurdish-government-cloud-environment","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3924","title":{"rendered":"DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.<\/p>\n

According to a report published<\/a> by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud environment in the Kurdistan Region.<\/p>\n

The activity has been attributed to a threat actor known as DarkBlinders<\/strong>, an Iran-nexus group assessed to be active since at least September 2024 and linked to attacks aimed at aviation infrastructure and telecommunications in the U.A.E. and Iraq. It exhibits no technical overlap with other known hacking groups.<\/p>\n

Attacks mounted by the group are known to rely on spear-phishing as an initial access pathway to lure recipients into opening trojanized utilities or clicking on attacker-controlled websites that host similar tools as direct downloads.<\/p>\n

Previous attack chains documented by Elastic Security Labs and Group-IB<\/a> have led to the deployment of SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT) that uses GitHub for command-and-control (C2), data exfiltration, and remote control. Elastic is tracking the threat cluster under the moniker REF8685. <\/p>\n

Then early last month, Palo Alto Networks shed light on a campaign dubbed Blinder Tunnel in which the threat actor, which it calls CL-STA-1178, was observed masquerading as the Dubai Airports IT department to distribute malware-laced coding challenges to high-value targets.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The bogus recruitment scheme was first detected in late March 2026, although evidence indicates that the attackers were staging and testing attack infrastructure as far back as November 2025.<\/p>\n

The social engineering campaign is assessed to have approached specific targets with lucrative job offers to trick them into executing a self-contained application that mimicked a career portal and instructed them to complete a questionnaire.<\/p>\n

Submitting the questionnaire does not cause any data to be exfiltrated or initiate any response from an external domain. Instead, it’s meant to serve as a harmless decoy and build credibility before delivering the next stage payload containing the malware in the form of a Microsoft Visual Studio project archive that’s dressed up as a coding assessment.<\/p>\n

The attack chain makes use of three techniques to establish persistent access: A malicious C# project \u00ab.csproj\u00bb file is used to trigger AppDomainManager injection, followed by DLL sideloading to deliver an updated version of SHELBYLOADER (aka ShelbyLoader V2), which then launches SHELBYC2. Also deployed via SHELBYC2 is a tunneling utility called Blackwood.<\/p>\n

\u00abThe attackers behind the activity used tailored social engineering techniques to masquerade as Dubai Airports recruiters, using a trojanized Visual Studio coding challenge to target a high-value job seeker based in Iraq,\u00bb Unit 42 said<\/a>.<\/p>\n

\u00abThe campaign is characterized by misuse of built-in developer tools and DLL sideloading. Attackers also used AppDomainManager hijacking to bypass security monitors like ETW<\/a> [Event Tracing for Windows].\u00bb<\/p>\n

The latest findings from Dream show that the threat actor continues to rely on social engineering, while combining both credential phishing and malware delivery. This involves the use of government, webmail, and cloud-service lookalike domains to collect credentials or present attacker-controlled file downloads. Some of the highlighted domains include –<\/p>\n