Between August and October 2026, a state-aligned Iranian cyberespionage group known as DarkBlinders carried out a sophisticated campaign targeting Israel and the Kurdistan Region of Iraq. The operation successfully breached a government cloud environment in Iraqi Kurdistan—exfiltrating more than 1 gigabyte of data—and compromised a high-profile individual in Israel’s security sector. These findings come from a new technical report released by Dream Research Labs.
How the Attack Unfolded
DarkBlinders relied on tailored social engineering schemes, including setting up fake sites that mimicked government webmail and cloud storage platforms. Some of the bogus domains impersonated Kuwait’s Ministry of Foreign Affairs, the Gulf Cooperation Council (GCC) Secretariat General, and even governmental cloud services associated with the Kurdistan Regional Government.
One of the key tools used was a fraudulent video-conferencing application named StarkMeet. Victims who installed this app were shown a functional-looking interface, but behind the scenes, components were dropped to ensure persistent access. Among these was a loader that used a.config-driven.NET technique (AppDomainManager hijacking) and sideloaded DLLs.
Initial access via credential phishing was followed by registration checkpoints: the infected systems sent host-level telemetry—username, machine name, domain, keyboard layout, anti-analysis status—to a GitHub repository under the “PeakyBlindersTeam/myLic” account. From about ten initially compromised hosts, only two were escalated to receive a full second-stage backdoor.
Command & Control, Persistence and Data Theft
Once activated, the second-stage payload (RuntimeBrokerApi.dll) connected back to a GitHub repository every roughly 63 seconds to pull down commands. PowerShell commands were run via an internal runspace using a component called PsProxy.dll to avoid launching powershell.exe outright—an evasion tactic.
The operation resulted in successful theft of over 1 GB of data from the Kurdistan Region’s government cloud environment. The compromised Israeli individual’s systems were also affected, though the report contains fewer technical details about that intrusion.
Researchers linked this campaign to other earlier waves of espionage previously documented by Elastic Security Labs, Unit 42, and Group-IB, as well as to established clusters like UNC5795, UNC5187, and APT34. Shared infrastructure, malware overlaps, and patterns of targeting helped build confidence in the attribution.
Some contextual clues—such as hosting environments, domain registration details, and Persian keyboard layout metadata—further support the assessment of an Iranian nexus for DarkBlinders, though definitive proof remains elusive.
The full report includes indicators of compromise, technical guidance for detecting phishing infrastructure, persistence mechanisms, and malicious command-and-control behavior.
This campaign highlights how nation-aligned actors continue to refine espionage operations, combining social engineering, supply-chain evasions, and staged escalation to target both individuals and institutional infrastructure. As governments and organizations in the region feed into these threat chains, they must strengthen detection of atypical process behavior and unusual remote connections—especially to code repositories like GitHub. The evolution of DarkBlinders shows that attackers aren’t just stealing data; they’re perfecting stealth, persistence, and precision. What to watch next: whether this mode of operation spreads to new sectors beyond government, and how defenders adapt to threats hiding in developer tools and public repositories.
