Iran-Linked DarkBlinders Stole at Least 1 GB From Kurdish Government Cloud
An Iran-aligned espionage group dubbed DarkBlinders compromised a high-profile individual in Israel's security sector and an Iraqi Kurdish government cloud environment, stealing at least 1 GB of data, according to Dream Research Labs. The campaign, observed between August and October 2026, used fake government login pages, the malicious StarkMeet video-conferencing app, and ShelbyLoader and SHELBYC2 malware, with command-and-control through GitHub. Researchers say a broader link to APT34 remains less certain; enforce strong authentication on high-profile accounts and review traffic to GitHub.
What happened
An Iran-aligned espionage group named DarkBlinders breached the Iraqi Kurdish government cloud environment and stole at least 1 GB of data, according to Dream Research Labs. The campaign, from August to October 2026, also compromised a high-profile individual in Israel's security sector.
Why it matters
Credentials stolen through fake login pages and a malicious meeting app gave the attackers remote access to a government's data. The same playbook works against any company with high-profile accounts and cloud services, and stolen data can feed surveillance and future operations.
What to do
Enforce strong multi-factor authentication on high-profile accounts and vet installed video-conferencing apps. Monitor outbound traffic to GitHub, abused as the command-and-control channel, and review cloud sessions and access for anything suspicious.
For the technical team
- Affected
- Vítimas do grupo DarkBlinders: um indivíduo israelense de alto perfil e um ambiente de nuvem governamental no Curdistão · Reported victims: a high-profile individual in Israel's security sector and a government cloud environment in Iraqi Kurdistan.
- Exploitation
- Campaign observed between August and October 2026 and detailed by Dream Research Labs; at least 1 GB of data stolen from the government cloud.
- Fix
- No product fix; operational mitigation: strong authentication on high-profile accounts, review of installed apps, and monitoring of traffic to GitHub.
- Vector
- Credential phishing via fake government login pages and a malicious video-conferencing app (StarkMeet) to steal credentials and deploy malware; GitHub abused for command-and-control, data theft and remote access.
- More details
- Dream Research Labs assesses the group as linked to an Iranian threat actor; a broader connection to APT34 remains less certain. The backdoor relies on GitHub as command-and-control infrastructure.
Indicators (IoCs)
- ShelbyLoader
- SHELBYC2
Timeline
New report details the campaign: at least 1 GB of data stolen from the Iraqi Kurdistan government cloud, with activity observed between August and October, using fake government login pages, the malicious StarkMeet video-conferencing app, and ShelbyLoader and SHELBYC2 malware, plus GitHub abused for
A Dream Research Labs report details the Iran-aligned group's espionage campaign, which ran from August to October 2026.
Incident opened.
Sources 3 sources
- @TheHackersNews @TheHackersNews
- DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment The Hacker News
- @DarkWebInformer @DarkWebInformer
