An Iran-linked hacking group called DarkBlinders has broken into a government cloud system in the Kurdistan Region of Iraq. The group stole at least 1 GB of data from it.

It also compromised a high-profile person in Israel who works in the security sector. The campaign ran from August to October 2026 and was still active when it was reported.

The same actor is behind Blinder Tunnel, a campaign that used a Dubai Airports coding test lure to target Iraqi infrastructure. Unit 42 documented that earlier work. This new wave shows the group is still active and keeps changing its tools.

Researchers at Dream noted the malware while tracking the group’s new activity. They reverse-engineered it and gained read-only access to the attacker’s command servers. That gave them a rare look at what the operators were doing to victims.

Iran-Linked DarkBlinders Hackers Breach Government Cloud Systems

The group began with fake login pages and fake downloads. Some copied Outlook Web App pages and posed as the Kuwait Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General.

These pages only collected usernames and passwords. A stolen login can open email, contacts, shared files and linked cloud services without setting off a malware alert. This is similar to the Iran-linked password spray campaign that hit Microsoft 365 tenants earlier this year.

Other lures copied Google Drive sharing links on domains themed around the Kurdistan Regional Government. The page said a ZIP file could not be previewed and told the victim to download it.

A fake video-meeting app named StarkMeet was the second delivery route. It showed a normal setup wizard and a working-looking meeting screen, but the Join button always failed.

While the decoy ran, hidden files were installed in a separate folder. They kept running even if the user removed StarkMeet. The malware sent details about the infected computer to a GitHub repository, and the operator reviewed them first.

Only chosen victims received the key needed to unlock the second-stage backdoor. About ten systems checked in, but only two victims showed up in the tasking channel.

The backdoor ran PowerShell commands inside its own process, so it never started powershell.exe. It could also upload and download files.

Recovered commands showed credential theft and the removal of at least 1 GB of data from the Iraqi government cloud. If GitHub shut down the account, the malware could read a hidden comment in the public Microsoft vscode repository to find new settings.

Who Is Behind DarkBlinders and How to Respond

Dream links DarkBlinders to UNC5795 and Dust Specter with medium-to-high confidence. It says, with medium confidence, that this cluster and UNC5187 may be related subclusters of APT34.

The evidence includes shared servers, matching malware and a similar focus on Iraqi government targets. The signs of an Iranian link are real but limited.

The first host to check in was a virtual machine with a Persian keyboard layout, and one decoy domain used ParsVDS name servers.

Dream says neither fact proves the operator’s identity on its own. Other Iran-linked groups work in similar ways. One example is the Seedworm signed binaries campaign, which hid behind trusted software.

Defenders should watch for fake meeting tools and for GitHub traffic that does not match normal developer work. They should also look for PowerShell running in unusual places and for login pages that imitate regional institutions.

Because GitHub and Cloudflare are shared platforms, block only the exact accounts and paths listed below, not the whole services. Quiet access like this often fits a wider pattern of Iranian hackers building access before they use it.

Indicators of compromise (IoCs):-

The report lists more SHA-256 hashes for build artifacts and lure-project files. They are:-

0702d54b03bf601019b6ad039f76ecc49b5b3e564119dfd60aebd742c8e90300, 13216e9942e15a48228005092f4e5ff8b7382d4ec73673f88c6d7b6c103cbce0, 1421fc1d0c06bf410b16f2cc44d49988c30cd64edf4dd08dd23ac64b28b5c641, 1d1754948c42a85f4b613dfe3de8cfb100d334da956244e4b58f5ea9d6463fed, 22beddd7fd5d6df6104fc4987ca892b6772c2b832ad31731f71d4de2e9d32c2b, 6ec2c97eeddf741a2f8dcd7b4c720c7f5a3f7afe5205ca1cf1e62d9199333e4b, 9d4b61dae9e00940305c6ad7d862713025c07f27ecb5f89e59bcbd3fbcf17965, 9d84672c95bfa4f2a3756053d21fd3b72508f51c7856837bd489f5edf283be10, aa7d4bf74edacba06da7e9d414c0649599fb0e7b118f7c3ddcec09eb3f720c82, c9178fef804f2d6a525c1af0a8ba49a5ec692bfaabd6043e5f0094fe93a31e82, aae2a7860f2e46019c38c1e7a50bc3b8f8104577acf750221c2cf23e6b376328, ac91ba73040ed42fb4eda1459bb8098e2f80970f2028da80c4e2f01e281cc223, b24a0c29134800dad72021e22d5ead99fa941722526807f29c131f6fbffa5fe2, c039da6d430f78fc2a405c8ae945d2114518a63d73857145bb244ab651e41f84, d8a4d54808c4705f472222c8a6ac5fd0622eb9bda7a2f07e12d712ea8b495d8e, dbd31b5d891d789e5cebbf0744a57b17c2f9a4fe50b79f64956e40dbb5fcaa9e, e325ba0f93dfdeeb8c35e159c54f9d4e796905056506f6d627f4d66f15fb9988, f2c54434e2eecca203c2114c0651e5d7a90fc2681117240686d084f016f9e2b6.

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.