Essential Insights
- DarkBlinders targeted Israel and Iraqi Kurdistan, compromising a high-profile Israeli individual and a government cloud environment.
- The group used spear-phishing and lookalike services to steal credentials or deliver malware; fake coding tests and StarkMeet apps installed ShelbyLoader V2 and the SHELBYC2 backdoor.
- Iran-linked Prince of Persia deployed a new U.S.-hosted C2 server for Tornado malware, which can be delivered through exploited software vulnerabilities and communicates via HTTPS and Telegram.
Threat, Techniques, and Targets
• Dream Research Labs reported that DarkBlinders, an Iran aligned threat actor, ran a cyber espionage campaign from August to October 2026. The campaign targeted a high profile person in Israel and a government cloud environment in the Kurdistan Region of Iraq.
• First, the group used social engineering and lookalike government, webmail, and cloud domains to seek credentials or deliver malware. It also used fake recruiter offers, coding challenges, and a counterfeit videoconferencing app called StarkMeet.
• A malicious Visual Studio project could trigger AppDomainManager injection and DLL sideloading. This chain delivered SHELBYLOADER V2, which launched the SHELBYC2 backdoor. The group also deployed the Blackwood tunneling utility.
Impact, Security Implications, and Remediation
• Researchers reported compromises in both target areas. The tools can support remote control and data exfiltration. However, the source does not confirm that attackers stole data from these victims.
• The group’s use of developer tools and AppDomainManager hijacking can challenge security monitoring. In addition, lookalike domains create a risk of credential theft.
• The source provides no specific remediation steps. Therefore, obtain current response and remediation guidance from the relevant vendors or authorities.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
