Researchers at Dream Research Labs have detailed a campaign by DarkBlinders, an Iran-nexus threat actor that compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq, according to The Hacker News. The group is assessed to have been active since at least September 2024 and has been linked to attacks on aviation and telecommunications in the United Arab Emirates and Iraq.
Job seekers in Iraq were also targeted through a fake recruitment scheme impersonating Dubai Airports. Delivery relied on spear-phishing with trojanized utilities or links to attacker-hosted downloads, credential phishing on lookalike government, webmail and cloud-service domains, a fake videoconferencing app called StarkMeet, and fake coding assessments delivered as Visual Studio project archives that use malicious project files to trigger AppDomainManager injection.
The infection chain uses DLL sideloading to load ShelbyLoader V2, which launches a backdoor called ShelbyC2 that uses GitHub for command and control. The operators also use a tunneling utility called Blackwood and hijack AppDomainManager to evade Event Tracing for Windows monitoring. The report does not say what data was taken from the compromised targets.
On attribution, Dream says DarkBlinders shows no technical overlap with other known groups, though Elastic tracks a related cluster as REF8685 and Palo Alto Networks tracks a related actor as CL-STA-1178. Dream says the activity belongs to the same cluster as UNC5795 and Dust Specter, and it separately assesses with medium confidence that UNC5795 and UNC5187 are sub-clusters of APT34. That second claim is not a direct attribution of DarkBlinders to APT34.