DarkBlinders targets Israeli individual and Iraqi government cloud
Original title: DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
Iran-aligned DarkBlinders compromises Israeli target and Iraqi Kurdish government cloud using spear-phishing and SHELBYC2.
A cyber espionage campaign by DarkBlinders compromised a high-profile Israeli individual and a government cloud environment in the Kurdistan Region of Iraq. The group uses spear-phishing and malware like SHELBYC2 via GitHub C2. The activity is attributed to an Iran-nexus threat actor with links to previous campaigns.
Unconfirmed: Relatedness to APT34 assessed with medium confidence
- Campaign active August to October 2026
- Uses trojanized utilities and coding challenges
- Malware includes SHELBYLOADER V2 and SHELBYC2
- Related to APT34 cluster per Dream Labs
Impact: data compromise and espionage
- Threat actors
- DarkBlinders
- Malware
- SHELBYLOADERSHELBYC2
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gcc-sg.cloud | d file downloads. Some of the highlighted domains include - gcc-sg[.]cloud/owa/auth/logon.aspx mfakuwait[.]online/owa/auth/logon.asp |
| domain | mfakuwait.online | ighted domains include - gcc-sg[.]cloud/owa/auth/logon.aspx mfakuwait[.]online/owa/auth/logon.aspx moelcloud[.]online/drive/file/d/1JpH3 |
| domain | moelcloud.online | /owa/auth/logon.aspx mfakuwait[.]online/owa/auth/logon.aspx moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O The threat |
| domain | stark-meet.com | for a fake videoconferencing application called StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website). Installi |
| domain | stark-meet.online | onferencing application called StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website). Installing and launching the |
| domain | stark-meet.website | alled StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website). Installing and launching the app leads to the execution |
| ipv4 | 68.65.122.203 | vernment, has been observed running one of its C2 servers ("68.65.122[.]203") from the U.S. this year. The server was likely built in |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.