Cybersecurity researchers have uncovered a sophisticated cyber espionage campaign attributed to DarkBlinders, a threat group linked to Iran. This campaign, active between August and October 2026, has targeted significant entities in Israel and the Kurdistan Region of Iraq, compromising a notable individual and a government cloud infrastructure, as per Dream Research Labs.
DarkBlinders’ Attack Tactics
DarkBlinders, active since September 2024, has been implicated in attacks on aviation and telecommunications sectors in the U.A.E. and Iraq. The group’s operations are distinct from other known hackers, primarily utilizing spear-phishing to gain initial access. Victims are lured into downloading malicious software disguised as utilities or visiting malicious websites.
Prior investigations by Elastic Security Labs and Group-IB revealed the deployment of a malware suite involving SHELBYLOADER, which uses DLL sideloading to install a backdoor known as SHELBYC2. This backdoor exploits GitHub for command-and-control operations, facilitating data theft and remote access.
Social Engineering and Deceptive Techniques
Recent analyses by Palo Alto Networks highlight a campaign termed Blinder Tunnel, where attackers posed as part of the Dubai Airports IT department to distribute malware through coding challenges. This elaborate scheme, reported since March 2026, utilized realistic job offers to trick targets into running malicious applications.
The deceptive strategy involved a fake career portal, with targets completing a questionnaire that served as a ruse. The actual threat emerged through a Visual Studio project containing malware, focusing on bypassing security via AppDomainManager hijacking and DLL sideloading, leading to the execution of enhanced SHELBYLOADER and SHELBYC2.
Continued Threat and Evolving Strategies
DarkBlinders persists in employing social engineering, combining phishing and malware dissemination tactics. Fake domains mimicking government and cloud services are used to harvest credentials or distribute malware. Notable decoy domains for a fake video conferencing app, StarkMeet, further illustrate their evolving strategies.
Connections with other threat clusters, such as UNC5795 and Dust Specter, suggest a broader operational framework linked to APT34. These findings imply a shared interest in targeting Iraqi government entities, reinforcing the assessment of their interconnected nature.
Prince of Persia’s U.S. Server Emergence
In a related development, the Iranian-backed Prince of Persia group has been detected operating a command-and-control server on U.S. soil for the first time in a decade. This infrastructure supports the Tornado variant malware, leveraging software vulnerabilities and utilizing HTTPS and Telegram API for communications.
Security experts have tracked Prince of Persia’s activities, noting a low victim count, possibly indicating precise targeting or challenges in expanding their reach. The timing coincides with rising hostilities between Iran and the U.S., marking a strategic shift in the threat actor’s operations.
