Dream Research Labs disclosed a cyber-espionage campaign by Iran-aligned actor DarkBlinders between August and October 2026 that compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. DarkBlinders, assessed active since at least September 2024 and previously linked to attacks on aviation infrastructure and telecommunications in the UAE and Iraq, relies on spear-phishing with trojanised utilities and attacker-controlled download sites; earlier chains documented by Elastic Security Labs (tracking the cluster as REF8685) and Group-IB deploy SHELBYLOADER via DLL side-loading to run the SHELBYC2 (AEROSTAT) backdoor, which uses GitHub for command-and-control. Palo Alto Networks separately described the actor (as CL-STA-1178) running "Blinder Tunnel", a recruitment-themed campaign posing as the Dubai Airports IT department with fake coding challenges. The report adds to a pattern of Iran-nexus operators extending compromise from Gulf aviation and telecoms into government cloud and high-value civilian targets, with no technical overlap to other known groups.

• Source article