DarkBlinders Compromises Israeli Individual and Iraqi Kurdish Government Cloud

Cyber Espionage Campaign Details

Cybersecurity researchers have revealed details of a cyber espionage campaign conducted by DarkBlinders, an Iran state-aligned threat actor. The campaign, active between August and October 2026, successfully compromised a high-profile individual in Israel and a government cloud environment within the Kurdistan Region of Iraq.

Attribution and Past Activities

DarkBlinders has been active since at least September 2024 and has no technical overlap with other known hacking groups. Previous attacks attributed to this group include targeting aviation infrastructure and telecommunications sectors in the U.A.E. and Iraq.

The group's tactics involve spear-phishing to trick targets into opening malicious utilities or downloading tools from attacker-controlled websites. Documented attack chains have led to the deployment of SHELBYLOADER, which uses DLL sideloading to execute the SHELBYC2 backdoor. SHELBYC2 utilizes GitHub for command-and-control, data exfiltration, and remote control.

Blinder Tunnel Campaign

Palo Alto Networks previously reported on a campaign called Blinder Tunnel, attributed to the same threat actor (tracked as CL-STA-1178). In this campaign, the group impersonated the Dubai Airports IT department to distribute malware-laced coding challenges. This bogus recruitment scheme was first detected in late March 2026, with infrastructure staging dating back to November 2025.

Social Engineering Tactics

The social engineering aspect of these attacks involves offering lucrative job opportunities to targets. Victims are enticed to execute a self-contained application mimicking a career portal and complete a questionnaire. This initial step acts as a decoy to build credibility before delivering the actual malware payload, disguised as a Microsoft Visual Studio project archive for a coding assessment.