Skip to content
DarkBlinders Targets Israeli and Kurdish Government Entities in Espionage Campaign

DarkBlinders Targets Israeli and Kurdish Government Entities in Espionage Campaign

First seen 2 Nov 2026, 17:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 19:47 UTC
  • •DarkBlinders targeted Israel and Kurdish government entities from August to October 2026.
  • •The group used spear-phishing and malware disguised as coding challenges for initial access.
  • •Phishing infrastructure impersonated Gulf governmental bodies, indicating broader targeting.

A cyber espionage campaign attributed to the Iran-aligned group DarkBlinders has compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The campaign, active from August to October 2026, utilized spear-phishing techniques to deliver malware disguised as coding challenges and other lures. The malware, including SHELBYLOADER and SHELBC2, was hosted on GitHub and involved tactics like DLL sideloading and PowerShell command execution. Broader targeting included Gulf governmental and diplomatic entities, with phishing infrastructure impersonating the Gulf Cooperation Council and Kuwait's Ministry of Foreign Affairs. The campaign's impact is ongoing, with researchers confirming active operations at the time of reporting.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-01
Espionage campaign begins
DarkBlinders initiated a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq.
The Hacker News
2026-10-31
Campaign remains active
Researchers confirmed the ongoing activity of the DarkBlinders campaign, affecting high-profile and governmental targets.
Dream Group
2026-11-02
Details disclosed
Cybersecurity researchers published findings detailing the methods and impacts of the DarkBlinders campaign.
Group-IB

More articles in this cluster (4)

Following this threat?

Track APT34 and Blackwood in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (25)

1 / 3

Common questions

Who is affected by this campaign?
The campaign has targeted a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq.
What methods are being used in the attacks?
The attackers are using spear-phishing techniques and malware disguised as coding challenges to gain access.
Is the campaign still ongoing?
Yes, researchers confirmed that the DarkBlinders campaign remains active as of the latest reports.