DarkBlinders APT targets Israel and Iraqi Kurdistan with StarkMeet and GitHub backdoors
Original title: DarkBlinders APT Hackers Target Israel and Iraqi Kurdistan With StarkMeet Malware and GitHub-Based Backdoors
DarkBlinders uses credential phishing and StarkMeet malware to compromise an Israeli security sector individual and Iraqi government cloud environment
DarkBlinders compromised a high-profile Israeli individual in the security sector and a government cloud environment in Iraqi Kurdistan. The campaign combined credential phishing, fake meeting applications, and GitHub-based backdoors. Researchers from Dream Security observed activity between August and October 2026, confirming at least 1 GB of data exfiltration from the government environment. The operation extends previous Blinder Tunnel campaigns.
- Targets include a security sector Israeli individual and Iraqi Kurdistan government cloud
- Uses StarkMeet as fake video meeting app with GitHub backdoors
- Persistence via Microsoft Runtime registry key
- Loader registers victims in PeakyBlindersTeam/myLic GitHub repo
- Selective deployment of second-stage implants
Impact: exfiltration of at least 1 GB from government environment and deployment of backdoors
- 1.monitor for GitHub repository activity
- 2.check for StarkMeet installer
- 3.review Run registry keys for persistence
- Products
- Windows
- Threat actors
- DarkBlinders
- Malware
- StarkMeet
- Organizations
- Dream Security
- Countries
- IsraelIraqi Kurdistan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gcc-sg.cloud | enterprise networks. IOCs Domain Description Target or role gcc-sg[.]cloud GCC Secretariat General cloud and webmail lure GCC and Gu |
| domain | gcc-sg.online | ariat General cloud and webmail lure GCC and Gulf diplomacy gcc-sg[.]online GCC Secretariat General webmail lure GCC and Gulf diploma |
| domain | mfakuwait.org | GCC Secretariat General webmail lure GCC and Gulf diplomacy mfakuwait[.]org Kuwait Foreign Affairs Outlook phishing Kuwait Note: IP a |
From the original article
3 min read at gbhackers.com
DarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.