Iranian State-Aligned Cyber Espionage Campaign Targets Israel and Kurdistan Region with Advanced Malware Loaders

Cybersecurity researchers have uncovered a sophisticated cyber espionage campaign orchestrated by an Iran state-aligned threat actor, targeting high-value entities across Israel and the Kurdistan Region of Iraq. The malicious activities, which took place between August and October 2026, reflect an ongoing evolution in the tactics, techniques, and procedures (TTPs) utilized by state-sponsored cyber actors in the Middle East, blending advanced software manipulation with targeted social engineering.

According to a detailed technical report published by Dream Research Labs, the campaign successfully compromised a high-profile individual within Israel. Additionally, the threat actors managed to infiltrate a government cloud environment situated in the Kurdistan Region of Iraq, demonstrating a broad geographical scope and a deliberate focus on strategic regional infrastructure.

The Rise of DarkBlinders and Evolving Delivery Vectors

The espionage activity has been definitively attributed to a threat group tracked under the moniker DarkBlinders. Security analysts assess this Iran-nexus collective has been operational since at least September 2024, previously tying the group to targeted cyberattacks against aviation and telecommunications infrastructure in the United Arab Emirates and Iraq. Crucially, technical analysis indicates that DarkBlinders exhibits no discernible code reuse or operational overlap with other well-documented APT (Advanced Persistent Threat) groups, marking it as a distinct and dedicated threat cluster.

Historically, attacks mounted by DarkBlinders have relied heavily on spear-phishing as an initial access vector. Victims are typically lured into opening trojanized utility applications or clicking on attacker-controlled web domains designed to host malicious payloads disguised as legitimate software downloads.

Previous attack chains thoroughly documented by security firms such as Elastic Security Labs—which tracks the cluster under the identifier REF8685—and Group-IB have centered around the deployment of specialized malware loaders. These operations typically deploy SHELBYLOADER, also known as HOTAIR, which is launched via DLL sideloading techniques. The loader subsequently executes a sophisticated backdoor designated as SHELBYC2, or AEROSTAT, which cleverly leverages GitHub repositories for command-and-control (C2) communications, remote control, and covert data exfiltration.

The operational tempo of the group shifted further last month when Palo Alto Networks shed light on an active campaign dubbed "Blinder Tunnel." During this phase, the threat actor—tracked separately by Palo Alto as CL-STA-1178—was observed impersonating the information technology department of Dubai Airports. Using this credible facade, the attackers distributed malware-laced coding challenges to high-value targets across the region.

Elaborate Social Engineering and Multi-Stage Infection Chains

This bogus recruitment scheme was initially detected in late March 2026, though forensic evidence indicates that the threat actors were actively staging, testing, and refining their attack infrastructure as far back as November 2025. The social engineering strategy relied heavily on approaching carefully selected targets with lucrative, highly appealing job opportunities. These overtures were designed to trick victims into executing a self-contained application that painstakingly mimicked a legitimate career portal, prompting the job seekers to complete an intake questionnaire.

Security researchers noted that submitting the initial questionnaire does not trigger any immediate data exfiltration or external network requests. Instead, this mechanism serves a psychological purpose, acting as a harmless decoy to establish operational credibility before the attackers deliver the subsequent stage payload. This next payload typically arrives in the form of a Microsoft Visual Studio project archive cleverly disguised as a mandatory technical coding assessment.

The underlying attack chain leverages a triad of distinct techniques to establish robust, persistent access within the target environment. First, a malicious C# project file with a .csproj extension is utilized to trigger AppDomainManager injection. This is swiftly followed by DLL sideloading to deliver an updated version of the malware, known as ShelbyLoader V2, which subsequently instantiates the SHELBYC2 backdoor. Furthermore, researchers have observed the deployment of a specialized tunneling utility called Blackwood via the SHELBYC2 framework.

"The attackers behind the activity used tailored social engineering techniques to masquerade as Dubai Airports recruiters, using a trojanized Visual Studio coding challenge to target a high-value job seeker based in Iraq," Unit 42 researchers explained in their analysis of the Blinder Tunnel campaign. "The campaign is characterized by misuse of built-in developer tools and DLL sideloading. Attackers also used AppDomainManager hijacking to bypass security monitors like ETW [Event Tracing for Windows]."

Diversification of Tooling and Infrastructure

The latest findings from Dream Research Labs indicate that the threat actor continues to refine its playbook by combining traditional credential phishing with direct malware delivery mechanisms. This dual approach frequently incorporates the registration of lookalike domains mimicking government portals, enterprise webmail services, and cloud platforms to harvest user credentials or host fraudulent file downloads.

Among the newly highlighted infrastructure are decoy brand domains established for a counterfeit videoconferencing application named StarkMeet, hosted on domains including stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website. Investigators discovered that installing and launching this deceptive application directly executes ShelbyLoader V2 and the associated SHELBYC2 backdoor, illustrating the group’s willingness to experiment with diverse software delivery vectors ranging from academic and professional coding tests to counterfeit productivity software.

Furthermore, Dream Research Labs assess with medium confidence that the DarkBlinders activity shares operational infrastructure and malware signatures with other known threat clusters, specifically UNC5795 and Dust Specter. Dust Specter was previously documented by Zscaler in March 2026 for targeting government officials in Iraq through sophisticated impersonation of the country’s Ministry of Foreign Affairs.

"Historical server fingerprints, overlapping victimology, and supporting attribution research lead us to assess with medium confidence that UNC5795 and UNC5187 may represent related sub-clusters within the broader APT34 group," the researchers noted. The overlapping operational focus on Iraqi government entities provides vital context, suggesting a coordinated intelligence collection mandate and a shared operational lineage.

Prince of Persia Resurfaces with C2 Infrastructure Hosted in the United States

Coinciding with these disclosures, fresh insights have emerged regarding another Iranian state-sponsored threat group known as "Prince of Persia," also tracked as Infy. This lesser-known hacking collective has been observed operating one of its primary command-and-control servers—specifically located at 68.65.122[.]203—directly from within the United States. Infrastructure analysis indicates this particular server was provisioned in July 2026.

The server functions as a second-stage C2 node associated with Tornado, a variant of the Tonnerre malware family typically dropped onto target systems via recently disclosed software vulnerabilities. The malware utilizes a combination of standard HTTPS protocols and the Telegram API for resilient command-and-control communications. The emergence of this new infrastructure follows a notable three-month operational hiatus that began earlier in the year, which security analysts described as the longest recorded period of inactivity in nearly two decades of tracked operations by the group.

"We have been monitoring Prince of Persia’s exfiltration activity for the past six months," said Tomer Bar, associate vice president of security research at Semperis. "The number of victims remains low, which could indicate either highly targeted attacks or difficulties infecting new victims."

Bar added a notable geopolitical observation regarding the deployment of infrastructure: "The Iranian threat actor decided to host its new C2 server on U.S. soil—at the same time as the beginning of the recent hostilities between Iran and the United States. This is the last place we expected to find the threat actor hiding."

As cybersecurity agencies and private threat intelligence firms continue to monitor these developments, organizations across the Middle East and internationally are advised to remain vigilant against advanced spear-phishing campaigns, unauthorized DLL sideloading, and the misuse of legitimate developer frameworks for persistent access.