DarkBlinders Hit Government Cloud, Israeli Target: 5 Things to Know
Table des matières
An Iran-linked espionage actor has run every documented wave of its campaign from public GitHub repositories, and in October a research team got inside them. Dream’s report shows the actor compromised a government cloud environment in Iraq’s Kurdistan Region and a high-profile individual in Israel between August and October 2026. Four vendors have tracked it under four different labels. The Hacker News covered the findings on November 2, and this is the full picture.
1. What is DarkBlinders?
Group-IB’s profile dates DarkBlinders to September 2024 and counts seven confirmed victim organizations in aviation and telecoms in the UAE and Iraq. The operators steal credentials and documents, not money, which points to intelligence collection. They also name everything after Peaky Blinders: the malware is SHELBYLOADER and SHELBYC2, and the GitHub accounts and domains carry the Shelby family name.
Group-IB’s profile, updated in June, said its own sightings had stopped and judged that the actor had probably evolved its tooling rather than retired. Unit 42 and Dream show it had. The malware changed. The GitHub command channel stayed.
2. What did Dream find?
Dream reverse-engineered the StarkMeet malware and found a GitHub access token embedded in the loader, according to GBHackers’ summary of the report. The token gave the researchers read-only access to the repositories the actor used to register victims and issue tasking. Elastic flagged the same design weakness in an earlier wave, where the attackers exposed their own GitHub tokens.
The tasking showed operators working against a government cloud environment in the Kurdistan Region and a high-profile Israeli individual associated with the security sector. Dream’s announcement adds that the actor stole credentials and exfiltrated at least 1 GB of cloud data. StarkMeet is a fake video-meeting app. It installs cleanly, shows a convincing meeting interface, and separately drops malware that survives removal of the app.
The repositories show restraint. Dream counted about ten initial host registrations but only two victims in the second-stage tasking channel, and only chosen victims received the key that unlocks the encrypted PowerShell backdoor. The lures targeted diplomats and officials: pages imitating Kuwait’s Ministry of Foreign Affairs and the GCC Secretariat General, fake government webmail logins, counterfeit cloud-drive pages, and Kurdistan-themed domains such as krgcloud[.]online and moelcloud[.]online. If the main channel fails, a recovery routine checks public Microsoft/vscode issue threads every hour for encrypted configuration hidden in comments.
3. Why does one actor have four names?
Four research teams documented pieces of it separately, and Dream connects the waves.
- DarkBlinders: Group-IB’s name for the intrusion set, and the name Dream uses.
- REF8685: Elastic’s label for the cluster behind the SHELBY malware, which targeted an Iraqi telecom and used GitHub for command and control.
- CL-STA-1178: Unit 42’s label for the actor, assessed with high confidence as Iranian state-aligned.
- Blinder Tunnel: Unit 42’s name for its March 2026 campaign, built on fake Dubai Airports recruiters and trojanized Visual Studio coding tests.
Unit 42’s October 6 report found no breach of Dubai Airports itself and one confirmed target, a likely software engineer in Iraq’s critical infrastructure sector. Reused infrastructure tied the campaign to an Israeli operation: a Google Drive lookalike page offering a file called WarUnPublishedDocuments.zip that led to a fake Google login page. Dream links its August to October wave to four earlier ones documented by Elastic, Unit 42, and Group-IB. That makes five waves, each with its own GitHub repository.
4. How sure are researchers it is Iran?
The vendors agree on the direction and differ on the confidence. Dream assesses with high confidence that the latest wave is the work of an Iranian actor in the DarkBlinders cluster, and with medium-to-high confidence that it overlaps with UNC5795 and Dust Specter. It assigns medium confidence to a relationship with UNC5187, which it places within APT34. Unit 42 also says high confidence for Iranian state alignment but rates similarities to specific known groups as low. Group-IB assesses the Iran link with low confidence and found no technical overlap with known groups. Treat the attribution as Iran-linked, not as a settled connection to APT34.
5. What you need to do now
Every wave starts with a lookalike domain, a fake app, or a stolen login. Check mail and proxy logs for the domains in the Dream and Group-IB reports, and block them. Watch GitHub API traffic from endpoints with no reason to talk to it, and watch DNS for abnormal resolutions, because Group-IB found the malware used DNS to fetch its second-stage decryption key. Treat any Visual Studio project from a recruiter as untrusted code. Unit 42 found the trap could fire when the project is opened, before anyone compiles it. Government, diplomatic, and critical infrastructure teams in the Gulf should also review webmail sign-ins and cloud storage access for activity they cannot explain.
Lookalike domains and stolen credentials are where CybelAngel looks first. Protection de votre marque detects and takes down malicious domains that impersonate your organization, and Credential Intelligence flags critical credential leaks before they are used. Group-IB’s UAE aviation wave started the same way: lookalike domains hosting credential-harvesting pages aimed at airline and airport staff.
À propos de l'auteur
