EN PT-BR
← Voltar ao feed
high government aviation telecommunications security cloud

Iran-nexus DarkBlinders (APT34-linked) breaches Israeli individual and Kurdistan government cloud with StarkMeet lure and GitHub C2

2 fonte(s) · 2 atualização(ões) · publicado 02/11/2026 11:46 · coletado há 21 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 04/11/2026 00:07; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ thehackernews.com ↗

DarkBlinders, an Iran-nexus espionage actor active since at least September 2024, ran a campaign between August and October 2026 that compromised a high-profile Israeli individual tied to the security sector and a government cloud environment in the Kurdistan Region of Iraq (thehackernews.com, gbhackers.com). The report comes from Dream Research Labs (thehackernews.com), which gbhackers.com calls Dream Security. The actor uses spear-phishing, credential-harvesting lookalike domains, the fake meeting app StarkMeet and trojanized utilities to deliver SHELBYLOADER (ShelbyLoader V2, aka HOTAIR) and the SHELBYC2 backdoor (aka AEROSTAT), which uses GitHub for C2 (thehackernews.com, gbhackers.com). Confirmed impact includes credential theft and exfiltration of at least 1 GB from the government environment, and the campaign was still active at the time of the latest report (gbhackers.com). Dream links DarkBlinders to UNC5795 and Dust Specter and, with medium confidence, to UNC5187 within APT34. The activity extends the "Blinder Tunnel" campaign (CL-STA-1178) previously documented by Unit 42. Separately, Semperis reports that Prince of Persia (Infy) is running a second-stage C2 in the US for the first time in a decade (thehackernews.com).

Detalhes técnicos

  • Initial access and lures: spear-phishing leads to trojanized utilities or attacker-controlled download sites (thehackernews.com). Phishing pages imitated government webmail, cloud-drive and meeting services, including Kuwait's Ministry of Foreign Affairs and the GCC Secretariat General. Outlook Web App lookalikes harvested credentials, and Google Drive-style pages pushed attacker-controlled archives (gbhackers.com). The original message delivering StarkMeet.zip was not recovered, so the delivery route is unconfirmed (gbhackers.com).
  • Phishing infrastructure (defanged): gcc-sg[.]cloud/owa/auth/logon.aspx, mfakuwait[.]online/owa/auth/logon.aspx, moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O. The StarkMeet decoy domains are stark-meet[.]com, stark-meet[.]online and stark-meet[.]website (thehackernews.com).
  • StarkMeet: an unsigned Inno Setup installer labeled version 3.2. It shows camera, microphone and screen-share previews, but joining a meeting always returns a fixed connection error. The decoy itself has no networking or payload-deployment functionality (gbhackers.com).
  • Loading and persistence: components are dropped under %LOCALAPPDATA%\Microsoft\RuntimeBroker. A legitimate signed vshost.exe, renamed RuntimeBroker.exe, loads RuntimeBroker.dll through an AppDomainManager-based mechanism. Persistence uses the MicrosoftRuntime value in the user's Run registry key, so the malicious branch survives removal of the visible app (gbhackers.com). ShelbyLoader is launched via DLL sideloading and runs SHELBYC2 (thehackernews.com). Elastic tracks the cluster as REF8685 (thehackernews.com).
  • GitHub-based C2: the loader uses an embedded GitHub personal access token to register victims in the PeakyBlindersTeam/myLic repository. Reports cover usernames, domains, keyboard layouts, persistence status and anti-analysis findings, which inform operator decisions rather than automatically terminating execution (gbhackers.com).
  • Second stage: about ten hosts registered, but only two victims appeared in the tasking repository. Selected hosts get host-specific activation material that unlocks RuntimeBrokerApi.dll. The key is AES-256-CBC derived from the SHA-256 of the license string, with the first 16 key bytes used as IV. The decrypted assembly runs in memory and polls for commands through myCode about every 63 seconds. The embedded PsProxy.dll runs PowerShell via System.Management.Automation runspaces without launching powershell.exe, and further commands support file upload, download and ZIP extraction (gbhackers.com).
  • Fallback channel: an hourly recovery mechanism searches public Microsoft/vscode issues for encrypted configuration hidden in comments. Valid instructions can replace repository ownership, repository names and tokens (gbhackers.com). The gbhackers.com text is truncated after this point.
  • Blinder Tunnel (Unit 42, CL-STA-1178): impersonated Dubai Airports recruiters and sent a trojanized Visual Studio coding challenge. It was first detected in March 2026, with infrastructure staged as early as November 2025. A malicious .csproj performs AppDomainManager injection (bypassing ETW monitoring), followed by DLL sideloading of ShelbyLoader V2 and SHELBYC2. SHELBYC2 also deploys the Blackwood tunneling utility (thehackernews.com).
  • Prince of Persia (Infy), Semperis: the US-hosted C2 68.65.122[.]203, likely built in July 2026, is tied to Tornado, a Tonnerre variant dropped via one-day software vulnerabilities. It uses HTTPS and the Telegram API for C2. New C2 servers emerged in late May 2026 after three months of inactivity, and victim numbers remain low (thehackernews.com).

Remediação

Neither source gives explicit vendor remediation. Based on the reported TTPs, defenders can block the listed domains and IP and hunt for DLL sideloading, AppDomainManager abuse and the MicrosoftRuntime Run key value. They should also scrutinize unsolicited recruitment, coding-assessment and meeting-app lures, and monitor GitHub-based C2 traffic (including the repositories named above). Credentials exposed on lookalike OWA or cloud-drive pages should be treated as compromised.

Relatos divergentes

  • Vendor naming: thehackernews.com attributes the research to Dream Research Labs, while gbhackers.com says Dream Security. They are presumably the same team, but the input does not confirm this.
  • Attribution confidence: thehackernews.com states that Dream assesses DarkBlinders is in the same cluster as UNC5795 and Dust Specter, without a confidence level. gbhackers.com (later) gives medium-to-high confidence for the overlap. On APT34, thehackernews.com says UNC5795 and UNC5187 may be related sub-clusters of APT34 (medium confidence), while gbhackers.com says DarkBlinders relates to UNC5187 within APT34 (medium confidence). Both agree the APT34 link is medium confidence only.
  • Victim profile: gbhackers.com adds that the Israeli victim is tied to the security sector and that at least 1 GB was exfiltrated. thehackernews.com does not mention these details.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 03:44 · coletado 03/11 04:00

    DarkBlinders APT targets Israel and Iraqi Kurdistan with StarkMeet fake meeting app and GitHub-based backdoors

    ler a análise desta fonte

    DarkBlinders compromised a high-profile Israeli individual tied to the security sector and a government cloud environment in Iraqi Kurdistan. The actor combined credential phishing, a fake meeting application (StarkMeet) and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026, and it was still active at publication. Confirmed activity included credential theft and exfiltration of at least 1 GB from the government environment. The operation extends the activity behind Unit 42's previously documented Blinder Tunnel campaign. Dream assesses with medium-to-high confidence that DarkBlinders overlaps with UNC5795 and Dust Specter, and with medium confidence that it relates to UNC5187 within APT34.

    Technical Details

    • Lures: government webmail, cloud-drive and meeting-service impersonation. Phishing pages imitated Kuwait's Ministry of Foreign Affairs and the GCC Secretariat General. Outlook Web App lookalikes harvested credentials, and Google Drive-style pages pushed attacker-controlled archives. The original message delivering StarkMeet.zip was not recovered, so the delivery route is unconfirmed.
    • StarkMeet is an unsigned Inno Setup installer labeled version 3.2. It posed as a video-meeting app with camera, microphone and screen-share previews, but joining a meeting always returned a fixed connection error. The decoy has no networking or payload-deployment functionality.
    • The installer dropped components under %LOCALAPPDATA%\Microsoft\RuntimeBroker. A legitimate signed vshost.exe, renamed RuntimeBroker.exe, loaded RuntimeBroker.dll through an AppDomainManager-based mechanism. Persistence used the MicrosoftRuntime value in the current user's Run registry key, so the malicious branch survives removal of the visible app.
    • The loader used an embedded GitHub personal access token to register victims in the PeakyBlindersTeam/myLic repository. Reports covered usernames, domains, keyboard layouts, persistence status and anti-analysis findings, which informed operator decisions instead of automatically terminating execution.
    • About ten hosts registered, but only two victims appeared in the second-stage tasking repository. Selected hosts received host-specific activation material that unlocked RuntimeBrokerApi.dll. The key was derived as AES-256-CBC from the SHA-256 of the license string, with the first 16 key bytes used as IV.
    • The decrypted assembly ran in memory and polled for commands through myCode about every 63 seconds. The embedded PsProxy.dll ran PowerShell through System.Management.Automation runspaces without launching powershell.exe. Further commands supported file upload, download and ZIP extraction.
    • An hourly recovery mechanism searched public Microsoft/vscode issues for encrypted configuration hidden in comments. Valid instructions could replace repository ownership, repository names and tokens.
    • Dream recovered historical license material from GitHub commit history and decrypted the payload using read-only access.

    Remediation

    The article gives no explicit remediation guidance.

  2. thehackernews.com ↗ · pub. 02/11/2026 11:46 · coletado 02/11 12:00 primeiro registro

    Iran-nexus DarkBlinders compromises Israeli individual and Kurdistan government cloud; Prince of Persia hosts C2 in US

    ler a análise desta fonte

    Dream Research Labs reports an espionage campaign by the Iran-nexus actor DarkBlinders between August and October 2026. It compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The group, active since at least September 2024, relies on spear-phishing, credential-harvesting lookalike domains and trojanized utilities to deliver SHELBYLOADER (ShelbyLoader V2) and the SHELBYC2 backdoor. Dream assesses that DarkBlinders belongs to the same cluster as UNC5795 and Dust Specter. It also assesses with medium confidence that UNC5795 and UNC5187 may be related sub-clusters of APT34. Separately, Semperis reports that Prince of Persia (Infy) is running a second-stage C2 server in the US for the first time in a decade.

    Technical Details

    • Initial access is spear-phishing that leads victims to trojanized utilities or attacker-controlled sites hosting direct downloads.
    • Dream observed credential phishing on government, webmail and cloud-service lookalike domains, including gcc-sg[.]cloud/owa/auth/logon.aspx, mfakuwait[.]online/owa/auth/logon.aspx and moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O.
    • Decoy domains for a fake videoconferencing app, StarkMeet (stark-meet[.]com, stark-meet[.]online, stark-meet[.]website), lead to execution of ShelbyLoader V2 and SHELBYC2.
    • SHELBYLOADER (aka HOTAIR) is launched via DLL sideloading and runs SHELBYC2 (aka AEROSTAT), which uses GitHub for C2, exfiltration and remote control. Elastic tracks the cluster as REF8685.
    • Palo Alto Networks Unit 42 documented the "Blinder Tunnel" campaign (CL-STA-1178), which impersonated Dubai Airports recruiters and sent a trojanized Visual Studio coding challenge. It was first detected in March 2026, with infrastructure staged as early as November 2025.
    • Persistence in that chain uses a malicious .csproj for AppDomainManager injection (bypassing ETW monitoring), then DLL sideloading of ShelbyLoader V2 and SHELBYC2. SHELBYC2 also deploys the Blackwood tunneling utility.
    • Prince of Persia's C2 68.65.122[.]203, likely built in July 2026, is tied to Tornado, a Tonnerre variant dropped via one-day software vulnerabilities. It uses HTTPS and the Telegram API for C2. New C2 servers emerged in late May 2026 after three months of inactivity, and victim numbers remain low.

    Remediation

    The article gives no explicit remediation. Defenders can block the listed domains and IP and hunt for DLL sideloading and AppDomainManager abuse. They can also scrutinize unsolicited recruitment and coding-assessment lures and monitor GitHub-based C2 traffic.