Iran-linked DarkBlinders breach government cloud systems, steal over 1 GB of data

An Iran-linked hacking group known as DarkBlinders compromised a government cloud system in Iraq’s Kurdistan Region and exfiltrated at least 1 GB of data.

The campaign also targeted and compromised a high-profile individual in Israel who works in the security sector. The activity ran from August to October 2026 and was still ongoing at the time it was reported.

Researchers note the same actor previously ran the “Blinder Tunnel” campaign, which used a Dubai Airports coding-test lure to target Iraqi infrastructure; Unit 42 documented that earlier activity. The new wave demonstrates the group remains active and continues to evolve its toolset.

Researchers at Dream observed the malware during tracking of the group’s activity. They reverse-engineered components and obtained read-only access to the attackers’ command servers, providing a rare view into the operators’ actions against victims.

Campaign tactics and delivery

The operation began with credential-harvesting pages and fake downloads. Several lures replicated Outlook Web App login pages and posed as the Kuwait Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General.

Those pages collected usernames and passwords. A stolen login can provide access to email, contacts, shared files, and linked cloud services without triggering a malware alert—similar to an Iran-linked password-spray campaign that affected Microsoft 365 tenants earlier in the year.

Other lures mimicked Google Drive sharing links on domains themed around the Kurdistan Regional Government. Those pages claimed a ZIP file could not be previewed and instructed victims to download it.

A fake video-meeting application branded “StarkMeet” served as a second delivery vector. The installer displayed a legitimate-looking setup wizard and an apparently working meeting screen, but the Join button always failed.

While the StarkMeet decoy ran, hidden components were installed into a different folder and continued to operate even if the user uninstalled StarkMeet. The malware reported information about the infected machine to a GitHub repository, where the operator reviewed the data.

Only selected victims received the key required to unlock the second-stage backdoor. Roughly ten systems checked in to the infrastructure, but only two victims appeared in the operator’s tasking channel.

The backdoor executed PowerShell commands from within its own process (it did not launch powershell.exe) and supported file upload and download operations.

Recovered command history shows credential theft and the removal of at least 1 GB of data from the Iraqi government cloud environment. If a GitHub account used for command-and-control were disabled, the malware was designed to read a hidden comment in a public Microsoft VS Code repository to obtain updated configuration.

Attribution and recommended response

Dream associates DarkBlinders with UNC5795 and Dust Specter with medium-to-high confidence, and states with medium confidence that this cluster and UNC5187 may be related subclusters of APT34.

Supporting evidence includes shared infrastructure, overlapping malware, and a similar targeting focus on Iraqi government entities. Indicators suggesting an Iranian link exist but are limited: the first host to check in used a Persian keyboard layout, and one decoy domain used ParsVDS name servers.

Dream cautions that these indicators alone do not definitively identify the operator; other Iran-linked groups employ comparable techniques—for example, the Seedworm signed-binaries campaign that concealed malicious code behind trusted software.

Defenders are advised to monitor for fake meeting applications and for GitHub traffic that is unusual for normal development activity. Look for PowerShell execution in unexpected contexts and phishing pages impersonating regional institutions.

Because platforms such as GitHub and Cloudflare are shared services, defenses should target only the specific accounts and paths listed in the indicators below rather than blocking entire services. The low-profile access pattern observed is consistent with a broader approach of establishing access quietly before escalation.

Indicators of compromise (IoCs)

The report also lists additional SHA-256 build and project hashes:

0702d54b03bf601019b6ad039f76ecc49b5b3e564119dfd60aebd742c8e90300, 13216e9942e15a48228005092f4e5ff8b7382d4ec73673f88c6d7b6c103cbce0, 1421fc1d0c06bf410b16f2cc44d49988c30cd64edf4dd08dd23ac64b28b5c641, 1d1754948c42a85f4b613dfe3de8cfb100d334da956244e4b58f5ea9d6463fed, 22beddd7fd5d6df6104fc4987ca892b6772c2b832ad31731f71d4de2e9d32c2b, 6ec2c97eeddf741a2f8dcd7b4c720c7f5a3f7afe5205ca1cf1e62d9199333e4b, 9d4b61dae9e00940305c6ad7d862713025c07f27ecb5f89e59bcbd3fbcf17965, 9d84672c95bfa4f2a3756053d21fd3b72508f51c7856837bd489f5edf283be10, aa7d4bf74edacba06da7e9d414c0649599fb0e7b118f7c3ddcec09eb3f720c82, c9178fef804f2d6a525c1af0a8ba49a5ec692bfaabd6043e5f0094fe93a31e82, aae2a7860f2e46019c38c1e7a50bc3b8f8104577acf750221c2cf23e6b376328, ac91ba73040ed42fb4eda1459bb8098e2f80970f2028da80c4e2f01e281cc223, b24a0c29134800dad72021e22d5ead99fa941722526807f29c131f6fbffa5fe2, c039da6d430f78fc2a405c8ae945d2114518a63d73857145bb244ab651e41f84, d8a4d54808c4705f472222c8a6ac5fd0622eb9bda7a2f07e12d712ea8b495d8e, dbd31b5d891d789e5cebbf0744a57b17c2f9a4fe50b79f64956e40dbb5fcaa9e, e325ba0f93dfdeeb8c35e159c54f9d4e796905056506f6d627f4d66f15fb9988, f2c54434e2eecca203c2114c0651e5d7a90fc2681117240686d084f016f9e2b6.

Note: IP addresses and domains are intentionally Q-defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.