Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

DarkBlinders Compromises Israeli Security Professional and Iraqi Kurdistan Cloud

3 sources · 3 articlesFirst reported Updated ()1
What's new

November 3: Cyber Security News adds specific lures impersonating Kuwait Ministry of Foreign Affairs and Gulf Cooperation Council, Google Drive links, and medium-to-high confidence link to UNC5795 and APT34.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Iran-aligned DarkBlinders compromised a high-profile Israeli security sector individual and Iraqi Kurdistan government cloud from August to October 2026, stealing at least 1 GB of data.

DarkBlinders, an Iran-nexus actor, ran a cyber espionage campaign from August to October 2026 targeting a high-profile Israeli security sector individual and a government cloud environment in Iraqi Kurdistan. Attackers used spear-phishing, credential harvesting via fake login pages impersonating Kuwait Ministry of Foreign Affairs and Gulf Cooperation Council, Google Drive links, and a StarkMeet decoy video-meeting app as lures. The malware delivered GitHub-hosted backdoors including SHELBYC2 for data exfiltration of at least 1 GB, with selective second-stage deployment. The group is linked to APT34 cluster and UNC5795.

Key facts
  • Compromised Israeli security sector individual and Iraqi Kurdistan government cloud
  • Campaign active August to October 2026
  • Stole at least 1 GB data from government environment
  • Uses StarkMeet fake app and SHELBYC2 GitHub backdoor
  • Lures include fake Kuwait MoFA and GCC login pages
  • Linked to APT34 cluster and UNC5795
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • The Hacker NewsLinks to prior Blinder Tunnel campaigns and SHELBYLOADER V2 trojanized utilities
  • GBHackersDetails StarkMeet decoy app, Microsoft Runtime registry persistence, and PeakyBlindersTeam/myLic GitHub repo
  • Cyber Security NewsSpecifies fake Kuwait MoFA and GCC login pages, Google Drive lures, and UNC5795 link
Products
Windows
Threat actors
DarkBlindersUNC5795APT34
Malware
SHELBYLOADERSHELBYC2StarkMeet
Victims
Kurdistan Regional GovernmentIsraeli security professionalIsraeli individualKurdistan Region of Iraq governmentIsraeli security sector individualIraqi Kurdistan government cloud
Organizations
Dream Security
Countries
IranIraqIsraelIraqi Kurdistan

Coverage

oldest first · one row per article · UTC
  1. · 1d ago The Hacker NewsFirst report

    DarkBlinders targets Israeli individual and Iraqi government cloud

    Iran-aligned DarkBlinders compromises Israeli target and Iraqi Kurdish government cloud using spear-phishing and SHELBYC2.

  2. · 23h ago GBHackers

    DarkBlinders APT targets Israel and Iraqi Kurdistan with StarkMeet and GitHub backdoors

    DarkBlinders uses credential phishing and StarkMeet malware to compromise an Israeli security sector individual and Iraqi government cloud environment

  3. · 22h ago Cyber Security News

    Iran-Linked DarkBlinders Hackers Breach Iraq Government Cloud and Steal 1GB Data

    The group stole at least 1 GB of data from a Kurdistan Region government cloud system and compromised a high-profile Israeli security sector professional.