Actor Profile

DarkBlinders is an Iran state-aligned threat actor active since at least September 2024. The group has no known technical overlap with other Iranian APT groups and has previously targeted aviation infrastructure and telecommunications in the U.A.E. and Iraq. Dream Research Labs assesses with medium confidence that DarkBlinders may be operationally related to UNC5795 and Dust Specter, with possible connections to the broader APT34 group based on infrastructure overlaps, shared victimology targeting Iraqi government entities, and common intelligence collection interests. The actor is also tracked as REF8685 by Elastic and CL-STA-1178 by Palo Alto Networks.

TTPs (Tactics, Techniques, Procedures)

DarkBlinders employs spear-phishing for initial access, using social engineering lures such as fake job recruitment schemes (masquerading as Dubai Airports IT department) and trojanized utilities. The group leverages AppDomainManager injection via malicious C# .csproj files, DLL sideloading to deploy SHELBYLOADER (HOTAIR/ShelbyLoader V2), and executes the SHELBYC2 (AEROSTAT) backdoor that uses GitHub for C2 and data exfiltration. Recent campaigns combine credential phishing via lookalike government/webmail/cloud-service domains with malware delivery through fake applications (StarkMeet videoconferencing app) and coding assessments. The actor deploys Blackwood tunneling utility and uses AppDomainManager hijacking to bypass Event Tracing for Windows (ETW). Relevant MITRE ATT&CK techniques include T1566 (Phishing), T1574.002 (DLL Side-Loading), T1055 (Process Injection), and T1071.001 (Web Protocols for C2).

Targets & Patterns

DarkBlinders targets government entities and high-profile individuals in the Middle East, with a specific focus on Israel and the Kurdistan Region of Iraq. The August-October 2026 campaign compromised a high-profile Israeli individual and government cloud infrastructure in Iraqi Kurdistan. Historical targeting includes aviation infrastructure and telecommunications in the U.A.E. and Iraq, as well as Iraqi government officials (via related cluster Dust Specter impersonating Iraq's Ministry of Foreign Affairs). The targeting pattern suggests intelligence collection objectives aligned with Iranian state interests, particularly focused on regional government entities and critical infrastructure. The use of tailored social engineering (fake recruitment for Dubai Airports, coding challenges) indicates careful target selection and reconnaissance of high-value individuals.

Historical Context

DarkBlinders has been active since at least September 2024, with the Blinder Tunnel campaign first detected in late March 2026 (infrastructure staging traced to November 2025). Previous attack chains documented by Elastic Security Labs and Group-IB established the SHELBYLOADER-to-SHELBYC2 deployment pattern. The March 2026 Dust Specter campaign (documented by Zscaler) targeted Iraqi government officials. Infrastructure and malware overlaps link DarkBlinders to UNC5795 and Dust Specter clusters, with medium-confidence assessment of operational relationship to APT34 based on shared victimology targeting Iraqi government entities. The actor has evolved tactics from simple trojanized utilities to sophisticated fake recruitment schemes and counterfeit software applications, demonstrating increasing operational maturity.

Defensive Recommendations

  • Monitor for suspicious .csproj files and AppDomainManager injection attempts (T1055) that bypass ETW; implement application whitelisting for build tools like MSBuild
  • Detect DLL sideloading activity (T1574.002) by monitoring for unsigned or unexpected DLLs loaded by legitimate applications; enable Sysmon Event ID 7 for image load tracking
  • Inspect GitHub API traffic for anomalous patterns indicative of C2 communication; SHELBYC2 uses GitHub for command-and-control and data exfiltration
  • Implement email security controls to detect spear-phishing (T1566) with recruitment themes, coding challenges, or links to lookalike government/webmail domains (gcc-sg[.]cloud, mfakuwait[.]online, moelcloud[.]online)
  • Deploy multi-factor authentication on cloud environments and monitor for credential harvesting attempts via phishing pages mimicking OWA and cloud service login portals

---

# Geopolitical Context

Geopolitical Context

The DarkBlinders campaign reflects Iran's sustained cyber intelligence collection priorities across the Middle East, targeting both its primary regional adversary Israel and Kurdish authorities in northern Iraq. The operation, spanning August to October 2026, demonstrates Tehran's continued investment in espionage capabilities against Israeli high-value individuals and Kurdish regional governance structures. The targeting of Iraqi Kurdistan is consistent with Iran's longstanding concerns about Kurdish autonomy movements and cross-border intelligence activities. The campaign's sophistication—employing credential phishing, malware delivery via fake recruitment schemes, and abuse of cloud infrastructure—indicates a maturing operational tradecraft. The possible linkage to APT34, a group historically associated with Iran's Ministry of Intelligence and Security (MOIS), suggests state-level tasking and resource allocation. The concurrent disclosure of Prince of Persia infrastructure hosted in the U.S. for the first time in a decade underscores Iran's evolving operational security calculus and willingness to diversify command-and-control geography.

State Actor Alignment

DarkBlinders is assessed by multiple threat intelligence vendors as an Iran state-aligned actor, active since at least September 2024. Dream Research Labs indicates with medium confidence that DarkBlinders may be operationally related to UNC5795, Dust Specter, and potentially APT34—a group widely attributed to Iran's Ministry of Intelligence and Security. The overlapping victimology (Iraqi government entities), shared infrastructure fingerprints, and malware tooling (SHELBYLOADER, SHELBYC2) support this assessment. The targeting pattern—Israeli high-value individuals and Kurdish government cloud environments—aligns with known Iranian intelligence priorities. No international sanctions have been publicly announced in connection with this specific campaign as of the reporting date, though APT34 has been subject to prior U.S. indictments and Treasury designations in separate operations.

Business Impacty pro region

The campaign has direct implications for Middle Eastern cybersecurity posture and regional stability. For Israel, the compromise of a high-profile individual represents a counterintelligence concern and may provide Iran with insights into Israeli policy deliberations or operational planning. For Iraqi Kurdistan, the breach of government cloud infrastructure threatens the confidentiality of administrative data and could expose sensitive communications related to regional governance, energy sector coordination, or security cooperation with external partners. European allies with diplomatic or commercial interests in the Kurdistan Region—particularly those involved in energy infrastructure or stabilization efforts—may face secondary risks if exfiltrated data includes information on joint projects or personnel. The use of fake Dubai Airports recruitment lures and Gulf Cooperation Council-themed phishing domains suggests an intent to map or penetrate networks across the broader Gulf region, potentially affecting U.A.E. and Kuwaiti entities. The campaign underscores the persistent cyber threat environment facing Middle Eastern governments and the need for enhanced cloud security hygiene and user awareness training.

Forecast

If DarkBlinders maintains operational tempo and continues to refine social engineering techniques—such as fake recruitment portals and counterfeit software—further compromises of government and private-sector targets in Israel, Iraq, and the Gulf states are likely in the coming months. If the assessed linkage to APT34 is accurate, the group may benefit from shared infrastructure, tooling, and targeting guidance, enabling more scalable operations. If Western or regional governments attribute these intrusions publicly and impose costs (e.g., through sanctions, indictments, or defensive cyber operations), Iran may temporarily adjust tradecraft or shift to alternative personas, though strategic intelligence collection priorities are unlikely to change. If Kurdish authorities and Israeli entities enhance detection capabilities and information-sharing with international partners, the operational lifespan of current DarkBlinders infrastructure and techniques may be reduced, forcing the group to invest in new initial access methods.