EN PT-BR
← Voltar ao feed
high government security cloud

DarkBlinders APT targets Israel and Iraqi Kurdistan with StarkMeet fake meeting app and GitHub-based backdoors

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 03:44 · coletado há 1 hora

DarkBlinders compromised a high-profile Israeli individual tied to the security sector and a government cloud environment in Iraqi Kurdistan. The actor combined credential phishing, a fake meeting application (StarkMeet) and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026, and it was still active at publication. Confirmed activity included credential theft and exfiltration of at least 1 GB from the government environment. The operation extends the activity behind Unit 42's previously documented Blinder Tunnel campaign. Dream assesses with medium-to-high confidence that DarkBlinders overlaps with UNC5795 and Dust Specter, and with medium confidence that it relates to UNC5187 within APT34.

Detalhes técnicos

  • Lures: government webmail, cloud-drive and meeting-service impersonation. Phishing pages imitated Kuwait's Ministry of Foreign Affairs and the GCC Secretariat General. Outlook Web App lookalikes harvested credentials, and Google Drive-style pages pushed attacker-controlled archives. The original message delivering StarkMeet.zip was not recovered, so the delivery route is unconfirmed.
  • StarkMeet is an unsigned Inno Setup installer labeled version 3.2. It posed as a video-meeting app with camera, microphone and screen-share previews, but joining a meeting always returned a fixed connection error. The decoy has no networking or payload-deployment functionality.
  • The installer dropped components under %LOCALAPPDATA%\Microsoft\RuntimeBroker. A legitimate signed vshost.exe, renamed RuntimeBroker.exe, loaded RuntimeBroker.dll through an AppDomainManager-based mechanism. Persistence used the MicrosoftRuntime value in the current user's Run registry key, so the malicious branch survives removal of the visible app.
  • The loader used an embedded GitHub personal access token to register victims in the PeakyBlindersTeam/myLic repository. Reports covered usernames, domains, keyboard layouts, persistence status and anti-analysis findings, which informed operator decisions instead of automatically terminating execution.
  • About ten hosts registered, but only two victims appeared in the second-stage tasking repository. Selected hosts received host-specific activation material that unlocked RuntimeBrokerApi.dll. The key was derived as AES-256-CBC from the SHA-256 of the license string, with the first 16 key bytes used as IV.
  • The decrypted assembly ran in memory and polled for commands through myCode about every 63 seconds. The embedded PsProxy.dll ran PowerShell through System.Management.Automation runspaces without launching powershell.exe. Further commands supported file upload, download and ZIP extraction.
  • An hourly recovery mechanism searched public Microsoft/vscode issues for encrypted configuration hidden in comments. Valid instructions could replace repository ownership, repository names and tokens.
  • Dream recovered historical license material from GitHub commit history and decrypted the payload using read-only access.

Remediação

The article gives no explicit remediation guidance.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 03:44 · coletado 03/11 04:00 primeiro registro

    DarkBlinders APT targets Israel and Iraqi Kurdistan with StarkMeet fake meeting app and GitHub-based backdoors

    ler a análise desta fonte

    DarkBlinders compromised a high-profile Israeli individual tied to the security sector and a government cloud environment in Iraqi Kurdistan. The actor combined credential phishing, a fake meeting application (StarkMeet) and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026, and it was still active at publication. Confirmed activity included credential theft and exfiltration of at least 1 GB from the government environment. The operation extends the activity behind Unit 42's previously documented Blinder Tunnel campaign. Dream assesses with medium-to-high confidence that DarkBlinders overlaps with UNC5795 and Dust Specter, and with medium confidence that it relates to UNC5187 within APT34.

    Technical Details

    • Lures: government webmail, cloud-drive and meeting-service impersonation. Phishing pages imitated Kuwait's Ministry of Foreign Affairs and the GCC Secretariat General. Outlook Web App lookalikes harvested credentials, and Google Drive-style pages pushed attacker-controlled archives. The original message delivering StarkMeet.zip was not recovered, so the delivery route is unconfirmed.
    • StarkMeet is an unsigned Inno Setup installer labeled version 3.2. It posed as a video-meeting app with camera, microphone and screen-share previews, but joining a meeting always returned a fixed connection error. The decoy has no networking or payload-deployment functionality.
    • The installer dropped components under %LOCALAPPDATA%\Microsoft\RuntimeBroker. A legitimate signed vshost.exe, renamed RuntimeBroker.exe, loaded RuntimeBroker.dll through an AppDomainManager-based mechanism. Persistence used the MicrosoftRuntime value in the current user's Run registry key, so the malicious branch survives removal of the visible app.
    • The loader used an embedded GitHub personal access token to register victims in the PeakyBlindersTeam/myLic repository. Reports covered usernames, domains, keyboard layouts, persistence status and anti-analysis findings, which informed operator decisions instead of automatically terminating execution.
    • About ten hosts registered, but only two victims appeared in the second-stage tasking repository. Selected hosts received host-specific activation material that unlocked RuntimeBrokerApi.dll. The key was derived as AES-256-CBC from the SHA-256 of the license string, with the first 16 key bytes used as IV.
    • The decrypted assembly ran in memory and polled for commands through myCode about every 63 seconds. The embedded PsProxy.dll ran PowerShell through System.Management.Automation runspaces without launching powershell.exe. Further commands supported file upload, download and ZIP extraction.
    • An hourly recovery mechanism searched public Microsoft/vscode issues for encrypted configuration hidden in comments. Valid instructions could replace repository ownership, repository names and tokens.
    • Dream recovered historical license material from GitHub commit history and decrypted the payload using read-only access.

    Remediation

    The article gives no explicit remediation guidance.