DarkBlinders, an espionage group that researchers link to Iran, broke into a government cloud system in the Kurdistan Region of Iraq and stole at least 1 GB of data. The same campaign also compromised a high-profile person in Israel who works in the security sector. Israeli security firm Dream found the intrusions and published its research in October 2026. The Hacker News, Cybersecurity News and several regional and international outlets have since reported on it. Dream says it saw post-compromise activity directly: it reverse-engineered the group's malware and got read-only access to the attackers' command servers, which were hosted on GitHub. The Kurdistan Regional Government has not commented publicly, and no government or national CERT statement on the breach has been published.
What Happened
Dream says the campaign was still running when it published. Accounts differ slightly on the dates. Dream's own research blog, The Hacker News, Cybersecurity News and Japan's NEXSIGHT Cyber Wire all describe the activity as running from August to October 2026. Dream's press release, distributed via EIN Presswire on October 11, and Green News Iraq's write-up of it say August and September. Dream's blog post is dated October 8, so the October activity was probably in progress when the press release was drafted.
Dream calls this the fifth wave of a longer campaign. It ties the activity to four earlier waves documented by Elastic Security Labs (which tracks the cluster as REF8685), Group-IB, and Palo Alto Networks' Unit 42. Unit 42's report on the "Blinder Tunnel" campaign, which it tracks as CL-STA-1178, described attackers posing as the Dubai Airports IT department and sending trojanized coding challenges to high-value targets. That campaign hit Iraqi critical infrastructure in March 2026, with infrastructure staging seen as early as November 2025. Unit 42 assessed with high confidence that the activity was carried out by an Iranian state-aligned actor. According to The Hacker News, the group has been active since at least September 2024 and has previously targeted aviation and telecommunications in the UAE and Iraq.
The attackers were selective. According to Dream's press release, about ten infected systems showed up in the first-stage check-in data. Only two identified victims appeared in the second-stage tasking channel, which means the operators reviewed each infected machine before deciding whether to escalate.
Phishing pages posing as the Gulf Cooperation Council Secretariat General and Kuwait's Ministry of Foreign Affairs suggest the group is also interested in Gulf government and diplomatic targets. Dream has not confirmed any compromise at those organisations.
What Was Taken
Dream confirmed two things: credentials were stolen, and at least 1 GB of data was taken from the Kurdistan Region government cloud environment. Every outlet covering the story uses the same "at least 1 GB" figure, and all of them trace it back to Dream. No other organisation has independently verified it.
Nobody has publicly described what the data was: which agency, what kind of documents, or whether it included personal records. Dream's phrasing ("at least") means 1 GB is a minimum, not a full count. Stolen credentials can be worth more than the files themselves. A working government login can give continued access to email, contacts, shared drives and linked cloud services, and using it does not set off malware alerts.
No details have been released about what was taken from the Israeli victim.
Why It Matters
This is espionage aimed at regional governments, not theft for money. The targets (Kurdish government systems, an Israeli security-sector figure, and lures themed on Gulf diplomatic bodies) fit long-running Iranian intelligence priorities.
Attribution is still disputed. NEXSIGHT Cyber Wire reports that Dream assesses with medium-to-high confidence that DarkBlinders belongs to the same cluster as the groups tracked as UNC5795 and Dust Specter, and with medium confidence that it may be a sub-cluster of APT34 (OilRig). The Hacker News, by contrast, says the group shows no technical overlap with other known hacking groups. Defenders should treat the APT34 link as a working theory, not a settled fact.
Using GitHub for command and control is the main detection problem. Traffic to GitHub's API looks like normal developer activity, and Dream found that each wave of the campaign used a different repository. GitHub took down the infrastructure Unit 42 identified, but the group came back with a new account (PeakyBlindersTeam) and kept operating.
The Attack Technique
Dream describes three ways in:
- Credential phishing. Fake Outlook Web App login pages posing as Kuwait's Ministry of Foreign Affairs and the GCC Secretariat General collected usernames and passwords.
- Fake cloud-drive shares. Pages imitating Google Drive, on domains themed around the Kurdistan Regional Government (and, according to NEXSIGHT, the Ministry of Electricity), told victims a ZIP file could not be previewed and had to be downloaded.
- StarkMeet. A fake video-meeting app (calling itself version 3.2, per NEXSIGHT) showed a normal setup wizard and meeting screen, but the Join button always failed. Meanwhile it installed malware into a separate folder, and that malware stayed in place even after StarkMeet was uninstalled. NEXSIGHT reports that Dream did not recover the original delivery message, so whether StarkMeet arrived by phishing email or a meeting invite is unconfirmed.
After infection, a first-stage loader with a built-in GitHub access token registered the machine and sent its system details to one repository. Operators reviewed that data and, for the systems they chose, provided material to decrypt and launch a second-stage backdoor in memory. NEXSIGHT says the AES-256 key could be rebuilt from key material left in the repository's commit history. The second stage used a separate token and repository to run PowerShell commands and transfer files.
This builds on the tradecraft Unit 42 documented in Blinder Tunnel: abusing Windows developer .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy ShelbyLoader V2, with GitHub repositories used to fetch keys and payloads and GitHub issues as a backup command channel. Elastic and Group-IB documented earlier versions as SHELBYLOADER (also called HOTAIR) and the SHELBYC2 backdoor (also called AEROSTAT). The "Peaky Blinders" naming shows up throughout. Unit 42 found the TV show's theme song embedded in the malware.
What Organizations Should Do
- Monitor GitHub API traffic from endpoints that have no reason to use it. Alert on api.github.com connections from non-developer machines, especially from processes that are signed but running from unusual folders, and look for embedded personal access tokens in binaries.
- Make phishing-resistant MFA mandatory on webmail and cloud tenants. The OWA and Drive lures only collect passwords. FIDO2 or passkey-based MFA makes those stolen passwords far less useful. Review recent sign-ins for new devices, locations and mailbox rules.
- Block meeting software from outside your approved list. Allow only approved conferencing clients and treat any "meeting app" link sent by email or message as a possible payload. Hunt for leftover files from programs that were uninstalled but whose components kept running.
- Look for DLL sideloading and AppDomainManager abuse. Flag signed executables loading DLLs from user-writable paths, unexpected .config files next to .NET binaries, and .csproj files arriving through recruitment or "coding test" channels.
- Brief staff at high-value targets. Government, diplomatic, defence and security-sector staff in Iraq, Israel and the Gulf should expect lures themed on Kurdish government services, GCC bodies, Gulf foreign ministries and fake job offers.
- Check your logs against the published indicators. Search for the indicators from Dream, Unit 42, Elastic and Group-IB going back to at least November 2025, and if you find matches, assume credentials are compromised: reset them and revoke active sessions.
Sources: Iran-Linked DarkBlinders Hackers Breach Government Cloud Systems an... | Blinder Tunnel Campaign Targets Iraqi Infrastructure | DarkBlinders: Active Espionage Campaign Dream Research | DarkBlinders Compromises Israeli Target and Iraqi Kurdish Governmen... | Dream Finds Iranian Cyberespionage Campaign Behind Kurdistan Govern... | Dream links Kurdistan cloud breach to Iranian cyberespionage Green... | DarkBlinders Hackers Leverage Fake Meeting App to Deploy Backdoor a... | イラン系攻撃者DarkBlindersがイスラエルとクルド自治区政府を諜報 — DreamがGitHub悪用型マルウェアの手口を解明...