Cybersecurity researchers have revealed a sophisticated cyber espionage operation conducted between August and October 2026 that targeted organizations in Israel and the Kurdistan Region of Iraq. The campaign, attributed to the Iran-aligned threat group DarkBlinders, reportedly resulted in the compromise of a prominent individual in Israel as well as intrusions affecting a government cloud environment in Iraqi Kurdistan.
According to findings released by Dream Research Labs, DarkBlinders has been active since at least late 2024 and has previously been associated with attacks against aviation and telecommunications infrastructure across the United Arab Emirates and Iraq. Researchers note that the group operates independently, with no significant technical overlap observed between its toolset and those of other known threat actors.
The group's operations continue to rely heavily on spear-phishing and social engineering. Victims are lured into opening weaponized software utilities or downloading malicious applications from attacker-controlled websites disguised as legitimate services. These techniques allow attackers to establish an initial foothold before deploying additional malware.
Earlier investigations by Elastic Security Labs and Group-IB linked DarkBlinders activity to the deployment of SHELBYLOADER, also known as HOTAIR. The malware is delivered through DLL sideloading techniques and ultimately installs a backdoor called SHELBYC2, or AEROSTAT. This backdoor leverages GitHub as a command-and-control channel while supporting remote access, data theft, and ongoing system control. Elastic tracks the broader activity cluster as REF8685.
More recently, Palo Alto Networks detailed a campaign known as Blinder Tunnel, where the threat actor, tracked internally as CL-STA-1178, impersonated recruiters from Dubai Airports' IT department. In this operation, carefully selected targets received what appeared to be lucrative employment opportunities accompanied by coding assessments.
The recruitment-themed attacks reportedly began surfacing in March 2026, although evidence suggests the infrastructure supporting the campaign had been under development and testing since November 2025. Targets were approached with convincing job offers and instructed to complete an interactive application that imitated a legitimate recruitment portal.
The questionnaire itself served primarily as a decoy, collecting no meaningful information and triggering no external communications. Its purpose was to build trust before victims received the next-stage payload: a malicious Microsoft Visual Studio project archive disguised as a technical coding challenge.
Researchers found that the attack chain combines multiple persistence mechanisms. A malicious Visual Studio project file initiates AppDomainManager injection, which is then followed by DLL sideloading to launch an updated variant of SHELBYLOADER, commonly referred to as ShelbyLoader V2. The malware subsequently deploys SHELBYC2, and in some cases an additional tunneling tool called Blackwood, enabling covert communications and remote network access.
Security analysts noted that the campaign demonstrates extensive abuse of legitimate developer tools and advanced Windows persistence techniques. By leveraging AppDomainManager hijacking, attackers can evade monitoring mechanisms such as Event Tracing for Windows (ETW), allowing malicious activity to remain hidden from many security controls.
The latest research indicates that DarkBlinders has broadened its delivery methods while continuing to rely on social engineering. Rather than focusing exclusively on malware-laced coding exams, the group now combines credential phishing with malicious file downloads.
To support these operations, attackers have registered domains designed to imitate government agencies, webmail platforms, and cloud services. These spoofed sites are used either to harvest credentials directly or distribute malware disguised as legitimate software.
Researchers also identified infrastructure linked to a fake videoconferencing platform named StarkMeet. The threat actor registered several lookalike domains promoting the counterfeit service. Victims who install and launch the application unknowingly trigger the execution of ShelbyLoader V2, which then installs SHELBYC2 to establish persistent access.
The evolving tactics suggest that DarkBlinders is actively experimenting with multiple malware-delivery approaches. While previous campaigns relied on fraudulent employment opportunities and coding assessments, newer operations demonstrate a shift toward distributing fake software products as alternative infection vectors.
Dream Research Labs further assessed that DarkBlinders shares infrastructure and malware characteristics with activity clusters known as UNC5795 and Dust Specter. The latter was previously documented by Zscaler as an Iran-linked operation targeting Iraqi government officials through websites impersonating Iraq's Ministry of Foreign Affairs.
Researchers also identified historical infrastructure overlaps and similarities in victim targeting between UNC5795 and UNC5187, leading to a moderate-confidence assessment that both may function as related subgroups within the broader APT34 espionage ecosystem. Their collective focus on Iraqi government institutions suggests a shared intelligence-gathering mission and possible operational coordination.
Prince of Persia Deploys U.S.-Hosted Infrastructure
Separately, researchers have observed another Iranian state-sponsored threat actor, Prince of Persia, also known as Infy, operating a command-and-control server from infrastructure located in the United States, marking a notable departure from historical behavior.
The server, believed to have been established in July 2026, functions as a second-stage command-and-control node supporting Tornado, a variant of the Tonnerre malware family. The malware is typically delivered through exploitation of recently disclosed software vulnerabilities and communicates through both HTTPS channels and the Telegram API.
Security researchers noted that the appearance of this infrastructure followed a three-month operational pause, representing the longest known period of inactivity for the group in nearly two decades.
Semperis researchers monitoring the campaign over the past six months report that the number of observed victims remains relatively limited. This could indicate either highly targeted intelligence operations or difficulties expanding infection rates among new targets.
Analysts also highlighted the unusual decision to host critical command-and-control infrastructure within the United States at a time of heightened geopolitical tensions involving Iran and the United States. The move represents a significant shift in the threat actor's operational behavior and suggests evolving efforts to conceal malicious activity within locations that defenders may not traditionally associate with Iranian cyber operations.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
