Iran-nexus DarkBlinders compromises Israeli individual and Kurdistan government cloud; Prince of Persia hosts C2 in US
Dream Research Labs reports an espionage campaign by the Iran-nexus actor DarkBlinders between August and October 2026. It compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The group, active since at least September 2024, relies on spear-phishing, credential-harvesting lookalike domains and trojanized utilities to deliver SHELBYLOADER (ShelbyLoader V2) and the SHELBYC2 backdoor. Dream assesses that DarkBlinders belongs to the same cluster as UNC5795 and Dust Specter. It also assesses with medium confidence that UNC5795 and UNC5187 may be related sub-clusters of APT34. Separately, Semperis reports that Prince of Persia (Infy) is running a second-stage C2 server in the US for the first time in a decade.
Detalhes técnicos
- Initial access is spear-phishing that leads victims to trojanized utilities or attacker-controlled sites hosting direct downloads.
- Dream observed credential phishing on government, webmail and cloud-service lookalike domains, including
gcc-sg[.]cloud/owa/auth/logon.aspx,mfakuwait[.]online/owa/auth/logon.aspxandmoelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O. - Decoy domains for a fake videoconferencing app, StarkMeet (
stark-meet[.]com,stark-meet[.]online,stark-meet[.]website), lead to execution of ShelbyLoader V2 and SHELBYC2. - SHELBYLOADER (aka HOTAIR) is launched via DLL sideloading and runs SHELBYC2 (aka AEROSTAT), which uses GitHub for C2, exfiltration and remote control. Elastic tracks the cluster as REF8685.
- Palo Alto Networks Unit 42 documented the "Blinder Tunnel" campaign (CL-STA-1178), which impersonated Dubai Airports recruiters and sent a trojanized Visual Studio coding challenge. It was first detected in March 2026, with infrastructure staged as early as November 2025.
- Persistence in that chain uses a malicious
.csprojfor AppDomainManager injection (bypassing ETW monitoring), then DLL sideloading of ShelbyLoader V2 and SHELBYC2. SHELBYC2 also deploys the Blackwood tunneling utility. - Prince of Persia's C2
68.65.122[.]203, likely built in July 2026, is tied to Tornado, a Tonnerre variant dropped via one-day software vulnerabilities. It uses HTTPS and the Telegram API for C2. New C2 servers emerged in late May 2026 after three months of inactivity, and victim numbers remain low.
Remediação
The article gives no explicit remediation. Defenders can block the listed domains and IP and hunt for DLL sideloading and AppDomainManager abuse. They can also scrutinize unsolicited recruitment and coding-assessment lures and monitor GitHub-based C2 traffic.
Linha do tempo
-
Iran-nexus DarkBlinders compromises Israeli individual and Kurdistan government cloud; Prince of Persia hosts C2 in US
ler a análise desta fonte ocultar
Dream Research Labs reports an espionage campaign by the Iran-nexus actor DarkBlinders between August and October 2026. It compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The group, active since at least September 2024, relies on spear-phishing, credential-harvesting lookalike domains and trojanized utilities to deliver SHELBYLOADER (ShelbyLoader V2) and the SHELBYC2 backdoor. Dream assesses that DarkBlinders belongs to the same cluster as UNC5795 and Dust Specter. It also assesses with medium confidence that UNC5795 and UNC5187 may be related sub-clusters of APT34. Separately, Semperis reports that Prince of Persia (Infy) is running a second-stage C2 server in the US for the first time in a decade.
Technical Details
- Initial access is spear-phishing that leads victims to trojanized utilities or attacker-controlled sites hosting direct downloads.
- Dream observed credential phishing on government, webmail and cloud-service lookalike domains, including
gcc-sg[.]cloud/owa/auth/logon.aspx,mfakuwait[.]online/owa/auth/logon.aspxandmoelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O. - Decoy domains for a fake videoconferencing app, StarkMeet (
stark-meet[.]com,stark-meet[.]online,stark-meet[.]website), lead to execution of ShelbyLoader V2 and SHELBYC2. - SHELBYLOADER (aka HOTAIR) is launched via DLL sideloading and runs SHELBYC2 (aka AEROSTAT), which uses GitHub for C2, exfiltration and remote control. Elastic tracks the cluster as REF8685.
- Palo Alto Networks Unit 42 documented the "Blinder Tunnel" campaign (CL-STA-1178), which impersonated Dubai Airports recruiters and sent a trojanized Visual Studio coding challenge. It was first detected in March 2026, with infrastructure staged as early as November 2025.
- Persistence in that chain uses a malicious
.csprojfor AppDomainManager injection (bypassing ETW monitoring), then DLL sideloading of ShelbyLoader V2 and SHELBYC2. SHELBYC2 also deploys the Blackwood tunneling utility. - Prince of Persia's C2
68.65.122[.]203, likely built in July 2026, is tied to Tornado, a Tonnerre variant dropped via one-day software vulnerabilities. It uses HTTPS and the Telegram API for C2. New C2 servers emerged in late May 2026 after three months of inactivity, and victim numbers remain low.
Remediation
The article gives no explicit remediation. Defenders can block the listed domains and IP and hunt for DLL sideloading and AppDomainManager abuse. They can also scrutinize unsolicited recruitment and coding-assessment lures and monitor GitHub-based C2 traffic.