Cybersecurity researchers have unveiled details of an active cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq. Active between August and October 2026, the operation is attributed to **DarkBlinders**, an Iran-nexus threat actor. According to a report by **Dream Research Labs**, the campaign led to the compromise of a prominent individual in Israel and affected a government cloud environment in the Kurdistan Region. ### The DarkBlinders Modus Operandi **DarkBlinders** has been active since at least September 2024, with previous attacks targeting aviation infrastructure and telecommunications in the U.A.E. and Iraq. The group exhibits no technical overlap with other known hacking entities. Initial access typically relies on spear-phishing, luring victims into opening trojanized utilities or downloading malicious tools from attacker-controlled websites. Previous attack chains, documented by **Elastic Security Labs** and **Group-IB**, deployed **SHELBYLOADER** (aka HOTAIR) via DLL sideloading. This loader then executes **SHELBYC2** (aka AEROSTAT), a backdoor that utilizes **GitHub** for command-and-control (C2), data exfiltration, and remote control. Elastic tracks this threat cluster as **REF8685**. ### Blinder Tunnel and Evolving Tactics Early last month, **Palo Alto Networks** detailed a campaign dubbed **Blinder Tunnel**, where the threat actor, identified as **CL-STA-1178**, impersonated the Dubai Airports IT department. This involved distributing malware-laced coding challenges to high-value targets.  The bogus recruitment scheme, first detected in late March 2026, was meticulously planned, with attack infrastructure being staged and tested as early as November 2025. Targets were approached with lucrative job offers and tricked into executing a self-contained application mimicking a career portal, instructing them to complete a questionnaire. This questionnaire served as a decoy to build credibility before delivering the actual malware within a **Microsoft Visual Studio** project archive disguised as a coding assessment. The attack chain leverages three persistence techniques: malicious C# project ".csproj" files for **AppDomainManager injection**, followed by DLL sideloading to deliver an updated **SHELBYLOADER V2**, which then launches **SHELBYC2**. A tunneling utility named **Blackwood** is also deployed via **SHELBYC2**. **Unit 42** highlighted the attackers' use of tailored social engineering, misuse of built-in developer tools, DLL sideloading, and **AppDomainManager** hijacking to bypass security monitors like **Event Tracing for Windows (ETW)**. ### Continued Social Engineering and New Delivery Methods Dream's latest findings indicate that **DarkBlinders** continues to rely on social engineering, combining credential phishing with malware delivery. This includes using lookalike domains for government, webmail, and cloud services to harvest credentials or present malicious file downloads. Examples of these domains include: * `gcc-sg[.]cloud/owa/auth/logon.aspx` * `mfakuwait[.]online/owa/auth/logon.aspx` * `moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O` The threat actor has also established decoy brand domains for a fake videoconferencing application called **StarkMeet** (`stark-meet[.]com`, `stark-meet[.]online`, and `stark-meet[.]website`). Installing and launching this counterfeit app leads to the execution of **ShelbyLoader V2** and **SHELBYC2**.  This diversification in malware delivery, from coding assessments to fake software, indicates an adaptive adversary. Dream assesses that the **DarkBlinders** activity belongs to the same operational cluster as **UNC5795** and **Dust Specter**, citing infrastructure and malware overlaps. **Dust Specter**, documented by **Zscaler** in March 2026, targeted Iraqi government officials by impersonating the country's Ministry of Foreign Affairs. Dream further suggests a medium-confidence assessment that **UNC5795** and **UNC5187** may be related sub-clusters within the broader **APT34** group, given their shared focus on Iraqi government entities and historical server fingerprints. ### Prince of Persia's Unusual C2 Location In a related development, **Prince of Persia** (aka Infy), another Iranian government-sponsored threat group, has been observed operating one of its C2 servers (`68.65.122[.]203`) from the U.S. this year. This marks the first time in a decade such infrastructure has been located within the United States. The server, likely built in July 2026, functions as a second-stage C2 for **Tornado**, a **Tonnerre** variant that exploits one-day software vulnerabilities and uses both HTTPS and the Telegram API for C2. This emergence of new C2 servers in late May 2026 follows a three-month period of inactivity, described as the "longest downtime in nearly two decades of activity by the threat actor." **Tomer Bar**, associate vice president of security research at **Semperis**, noted the low number of victims, suggesting highly targeted attacks or difficulties in infection. He expressed surprise at the Iranian threat actor hosting its new C2 server on U.S. soil, particularly amidst recent hostilities between Iran and the United States.