Iran-Linked DarkBlinders Hackers Breach Government Cloud Systems and Steal Over 1GB of Data

An Iran-linked hacking group called DarkBlinders has broken into a government cloud system in the Kurdistan Region of Iraq. The group stole at least 1 GB of data from it.

It also compromised a high-profile person in Israel who works in the security sector. The campaign ran from August to October 2026 and was still active when it was reported.

The same actor is behind Blinder Tunnel, a campaign that used a Dubai Airports coding test lure to target Iraqi infrastructure. Unit 42 documented that earlier work. This new wave shows the group is still active and keeps changing its tools.

Researchers at Dream noted the malware while tracking the group’s new activity. They reverse-engineered it and gained read-only access to the attacker’s command servers. That gave them a rare look at what the operators were doing to victims.

Iran-Linked DarkBlinders Hackers Breach Government Cloud Systems

The group began with fake login pages and fake downloads. Some copied Outlook Web App pages and posed as the Kuwait Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General.

These pages only collected usernames and passwords. A stolen login can open email, contacts, shared files and linked cloud services without setting off a malware alert. This is similar to the Iran-linked password spray campaign that hit Microsoft 365 tenants earlier this year.

Other lures copied Google Drive sharing links on domains themed around the Kurdistan Regional Government. The page said a ZIP file could not be previewed and told the victim to download it.

A fake video-meeting app named StarkMeet was the second delivery route. It showed a normal setup wizard and a working-looking meeting screen, but the Join button always failed.

While the decoy ran, hidden files were installed in a separate folder. They kept running even if the user removed StarkMeet. The malware sent details about the infected computer to a GitHub repository, and the operator reviewed them first.

Only chosen victims received the key needed to unlock the second-stage backdoor. About ten systems checked in, but only two victims showed up in the tasking channel.

The backdoor ran PowerShell commands inside its own process, so it never started powershell.exe. It could also upload and download files.

Recovered commands showed credential theft and the removal of at least 1 GB of data from the Iraqi government cloud. If GitHub shut down the account, the malware could read a hidden comment in the public Microsoft vscode repository to find new settings.

Who Is Behind DarkBlinders and How to Respond

Dream links DarkBlinders to UNC5795 and Dust Specter with medium-to-high confidence. It says, with medium confidence, that this cluster and UNC5187 may be related subclusters of APT34.

The evidence includes shared servers, matching malware and a similar focus on Iraqi government targets. The signs of an Iranian link are real but limited.

The first host to check in was a virtual machine with a Persian keyboard layout, and one decoy domain used ParsVDS name servers.

Dream says neither fact proves the operator’s identity on its own. Other Iran-linked groups work in similar ways. One example is the Seedworm signed binaries campaign, which hid behind trusted software.

Defenders should watch for fake meeting tools and for GitHub traffic that does not match normal developer work. They should also look for PowerShell running in unusual places and for login pages that imitate regional institutions.

Because GitHub and Cloudflare are shared platforms, block only the exact accounts and paths listed below, not the whole services. Quiet access like this often fits a wider pattern of Iranian hackers building access before they use it.

Indicators of compromise (IoCs):-

Type	Indicator	Role
Domain	gcc-sg[.]cloud, gcc-sg[.]online	GCC webmail lures
Domain	mfakuwait[.]org, mfakuwait[.]online, mfakuwait[.]website, mofakuwait[.]online	Kuwait Foreign Affairs lures
Domain	krgcloud[.]online, moelcloud[.]online, korektell[.]com	Kurdistan-themed lures
Domain	starkmeet[.]com, stark-meet[.]com, stark-meet[.]online, stark-meet[.]website	StarkMeet decoy and download
Domain	drive-g[.]cloud, cdndrive[.]online, cdn-gdrive[.]cloud, drive-go[.]cam	Drive-style delivery
Domain	meetgooge[.]online, meetgooge[.]cam, meet-goo[.]cam, meetonline[.]cam	Meeting lures
Domain	g-prx.itugegape524.workers[.]dev	Cloudflare Worker proxy
URL	hxxps://stark-meet[.]com/wp-content/uploads/2025/08/StarkMeet.zip	Payload delivery
URL	hxxps://api.github[.]com/repos/PeakyBlindersTeam/myLic	C2 (registration)
URL	hxxps://api.github[.]com/repos/PeakyBlindersTeam/myCode	C2 (tasking)
URL	hxxp://194.62.249[.]114/8001	Direct service
IP	194.62.249[.]19, 194.62.249[.]114, 194.62.249[.]53	UK hosting
IP	89.125.209[.]80, 78.17.71[.]148	Netherlands hosting
IP	77.223.215[.]140	Germany hosting
SHA-256	53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402	RuntimeBroker loader
SHA-256	3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13	PowerShell helper
SHA-256	824b36b9af74655a2c53b73959c144028b1f8ccc7c45ef17455d020b74cd0a51	StarkMeet decoy executable
SHA-256	8c68119ebef2ec4be1d57f867ecc1e3606f819bd6278d35a95c6d9b789ac0bfd	StarkMeet delivery archive
SHA-256	770646093df203013b190ef0b0baa9dd2f6834534970a57ac5dc4be9b22ad28e	Kuwait Outlook phishing page
SHA-256	3f1961c951c105f289e64a8933c7d1ee34d71f1964999c01e97f2d944dfdc33c	Kuwait HTML phishing document
SHA-256	3fde5576233852cb9fdc0d6c2c4956a8eaa0857c2bbd86c388d7b4e10f11b0e8	Kuwait credential page
SHA-256	11d1d570b5db7639d56a40621045e96c33b3d1ec3ae49e63c2ff07b9865844d4	StarkMeet installer variant
SHA-256	9ceb74f9ca2b0e9e1f0e579bfbb5d3d376667165eff9b8cda616b1c4a74236b9	StarkMeet installer variant
SHA-256	3f76edab26d08b1517a15bde8ca82e94d48b4cbedd005eb11c950cfd6d9a8982	Packed StarkMeet variant
SHA-256	87bd8af14932f132bb3df9a6b8c17748c3e114432e217816a88ba35ec9a381f4	StarkMeet executable variant
SHA-256	39da663f083fad0ad8dcaac90b0760d166e2aa911f90a3c311a8121badc16020	StarkMeet uninstaller
SHA-256	3ab16d953c71738788ef2f39b62cf47284750e98aada273187954536e1ee1c83	Shortcut launching hidden component
SHA-256	8875a41ead3b17eb8538466bfecb211a52d7ee56fa6e496b4407bdb0caa51dc5	Signed host repurposed by loader
SHA-256	0c9869b4aa7dde55936ab8726c442368b722eb69b785ef5c8e24938a01fdee89	Loader configuration
SHA-256	85c119297f42f09f9414e138b8f137a3e2dac1ee56fb6ae79c4c5044bc87bd80	JSON configuration
SHA-256	415eb0d0055bc113df2da361b35c4de65ff55d5cddea3b637660b3ad19848ebd	Credential phishing page
SHA-256	48e6a4196bff405b8b8ef80dcba599b93cb0428f3e587da90be6020e2337c83e	HTML page for StarkMeet brand
MD5	482c32947763a613199c43f7b4760f33	Listed without file context
SHA-256	052702d652286482863a70eaa37e4fc894f40c8b08dccf245ced46916e7f419f	Dubai Airport lure executable
SHA-256	06d68dcb8088546cb40fb3d7e87d6a593cbdf4cc1e43017604faf786ad6dbd41	Malicious .NET payload
SHA-256	6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239	Dubai Airport lure archive
SHA-256	f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9	Weaponized project file

The report lists more SHA-256 hashes for build artifacts and lure-project files. They are:-

0702d54b03bf601019b6ad039f76ecc49b5b3e564119dfd60aebd742c8e90300, 13216e9942e15a48228005092f4e5ff8b7382d4ec73673f88c6d7b6c103cbce0, 1421fc1d0c06bf410b16f2cc44d49988c30cd64edf4dd08dd23ac64b28b5c641, 1d1754948c42a85f4b613dfe3de8cfb100d334da956244e4b58f5ea9d6463fed, 22beddd7fd5d6df6104fc4987ca892b6772c2b832ad31731f71d4de2e9d32c2b, 6ec2c97eeddf741a2f8dcd7b4c720c7f5a3f7afe5205ca1cf1e62d9199333e4b, 9d4b61dae9e00940305c6ad7d862713025c07f27ecb5f89e59bcbd3fbcf17965, 9d84672c95bfa4f2a3756053d21fd3b72508f51c7856837bd489f5edf283be10, aa7d4bf74edacba06da7e9d414c0649599fb0e7b118f7c3ddcec09eb3f720c82, c9178fef804f2d6a525c1af0a8ba49a5ec692bfaabd6043e5f0094fe93a31e82, aae2a7860f2e46019c38c1e7a50bc3b8f8104577acf750221c2cf23e6b376328, ac91ba73040ed42fb4eda1459bb8098e2f80970f2028da80c4e2f01e281cc223, b24a0c29134800dad72021e22d5ead99fa941722526807f29c131f6fbffa5fe2, c039da6d430f78fc2a405c8ae945d2114518a63d73857145bb244ab651e41f84, d8a4d54808c4705f472222c8a6ac5fd0622eb9bda7a2f07e12d712ea8b495d8e, dbd31b5d891d789e5cebbf0744a57b17c2f9a4fe50b79f64956e40dbb5fcaa9e, e325ba0f93dfdeeb8c35e159c54f9d4e796905056506f6d627f4d66f15fb9988, f2c54434e2eecca203c2114c0651e5d7a90fc2681117240686d084f016f9e2b6.

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.