Researchers Link Iran-Aligned Group to Breaches in Israel and Iraqi Kurdistan

Cybersecurity researchers have published findings on a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq, attributed to an Iran-aligned threat actor tracked as DarkBlinders.

According to a report from Dream Research Labs, the campaign, observed between August and October 2026, resulted in the compromise of a high-profile individual in Israel and affected a government cloud environment in the Kurdistan Region.

The group is assessed to have been active since at least September 2024, with prior attacks on aviation and telecommunications infrastructure in the U.A.E. and Iraq. Its methods include spear-phishing that tricks recipients into opening trojanized utilities or visiting attacker-controlled download sites.

Earlier research from Elastic Security Labs and Group-IB documented the group deploying a loader known as SHELBYLOADER, which uses DLL sideloading to run a backdoor called SHELBYC2 that relies on GitHub for command-and-control and data exfiltration. Palo Alto Networks later described a campaign, dubbed Blinder Tunnel, in which the actor posed as Dubai Airports IT staff to deliver malware hidden in coding challenges to high-value targets.

Dream reported that the group continues to combine credential phishing with malware delivery, using lookalike government, webmail and cloud-service domains, as well as decoy sites for a fake videoconferencing app called StarkMeet. The researchers said DarkBlinders shares infrastructure and malware overlaps with clusters tracked as UNC5795 and Dust Specter, and assessed with medium confidence that these may be related sub-clusters within the broader APT34 group.

Separately, researchers reported that Prince of Persia, a lesser-known Iran-sponsored group, ran a command-and-control server from the U.S. this year. "The Iranian threat actor decided to host its new C2 server on U.S. soil," said Tomer Bar of Semperis, calling it "the last place we expected to find the threat actor hiding."

Source: The Hackers News