"The attackers behind the activity used tailored social engineering techniques to masquerade as Dubai Airports recruiters, using a trojanized Visual Studio coding challenge to target a high-value job seeker based in Iraq," Unit 42 said.
DarkBlinders: who was hit, when, and what was taken
Cybersecurity researchers at Dream Research Labs report that an Iran-aligned threat actor tracked as DarkBlinders carried out a targeted espionage campaign between August and October 2026. The campaign resulted in the compromise of a high-profile individual in Israel and additional compromises affecting a government cloud environment in the Kurdistan Region of Iraq. Dream Research Labs attributes the activity to DarkBlinders and notes the group has been active since at least September 2024.
Social engineering, lure types, and phish domains
The operation relied on credential phishing and bespoke social engineering to collect credentials and deliver malware. Dream highlighted lookalike domains and decoy services used by the attackers, including government- and cloud-themed sites such as gcc-sg[.]cloud/owa/auth/logon.aspx, mfakuwait[.]online/owa/auth/logon.aspx, and moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O. The actor also created decoy brand domains for a fake videoconferencing application called StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website), where installing and launching the app led to execution of malware.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFrom coding tests to DLL sideloading: the delivery and persistence chain
Dream and other observers describe a range of delivery methods. One notable technique impersonated Dubai Airports recruiters and used a trojanized Visual Studio coding challenge to build credibility; the initial questionnaire behaved as a harmless decoy but the follow-on payload was a Microsoft Visual Studio project archive posing as a coding assessment. The attack chain used three persistence techniques: a malicious C# project ".csproj" file to trigger AppDomainManager injection, DLL sideloading to deliver an updated SHELBYLOADER (ShelbyLoader V2), and subsequent execution of SHELBYC2. The SHELBYC2 implant also deployed a tunneling utility called Blackwood.
Malware, historic links, and overlapping clusters
Elastic Security Labs and Group-IB previously documented related attack chains that deployed SHELBYLOADER (also known as HOTAIR) and SHELBYC2 (also known as AEROSTAT), with GitHub used for command-and-control, data exfiltration, and remote control. Palo Alto Networks described a related campaign named Blinder Tunnel that began in late March 2026, with staging and testing activity traceable to as early as November 2025. Dream Research Labs assesses DarkBlinders activity belongs to the same operational cluster as UNC5795 and Dust Specter and notes infrastructure and malware overlaps; it further assesses with medium confidence that UNC5795 and UNC5187 may represent related sub-clusters within the broader APT34 group based on server fingerprints, overlapping victimology, and attribution research.
Prince of Persia: a separate Iranian-linked actor using U.S.-hosted C2
Separately reported activity shows another Iran-aligned group, Prince of Persia (aka Infy), placed a command-and-control server in the United States in 2026. Semperis researchers observed a C2 server at 68.65.122[.]203 likely built in July 2026 and associated with Tornado — a Tonnerre variant dropped via one-day software vulnerabilities that uses HTTPS and the Telegram API for C2. Tomer Bar, associate vice president of security research at Semperis, said, "We have been monitoring Prince of Persia's exfiltration activity for the past six months" and added that the number of victims remains low, which he said could "indicate either targeted attacks or difficulties infecting new victims." Bar also noted, "The Iranian threat actor decided to host its new C2 server on U.S. soil — at the same time as the beginning of the recent hostilities between Iran and the United States. This is the last place we expected to find the threat actor hiding."
What this means for technologists, policymakers, and affected governments
- Technologists and security teams: expect continued use of developer tooling and DLL sideloading in targeted social-engineering campaigns, including AppDomainManager hijacking and trojanized Visual Studio projects that act as multi-stage vectors for SHELBYLOADER, SHELBYC2, and tunneling utilities such as Blackwood.
- Policymakers and regulators: the presence of Iran-aligned clusters using lookalike government and cloud domains, and the documented cross-border targeting of Israeli and Iraqi Kurdish government assets, underscores an intelligence-collection focus that may shape intergovernmental briefings and incident-response coordination.
- Affected enterprises and procurement leaders: counterfeit software (StarkMeet) and bogus career portals demonstrate adversaries will dress malicious payloads as legitimate applications or recruitment flows; procurement and HR teams should treat unsolicited job offers with elevated caution and validate downloads and test artifacts through security channels.
DarkBlinders' recent activity combines tried-and-tested social engineering with evolving delivery methods, and researchers warn the operational cluster overlaps with other Iran-nexus groups. The report leaves a concrete operational footprint — domains, malware families, and an IP-addressed C2 — that defenders can use to hunt and harden; whether those artifacts will be enough to impede further intrusions into the near term is the question now on the table.
Original reporting: https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html
