Iran-aligned DarkBlinders breaches a Kurdish government cloud using fake Dubai Airports job lures
Dream Research Labs has tied an Iran-nexus espionage cluster, DarkBlinders, to an August–October campaign that compromised a high-profile individual in Israel and a government cloud environment in Iraq's Kurdistan Region. Lures included a fake videoconferencing app and recruiter personas impersonating Dubai Airports with trojanised coding challenges.
While Iranian-linked sabotage crews make headlines, quieter espionage operations are expanding alongside them. The Hacker News reported on 2 November that Dream Research Labs has attributed a campaign running from August to October 2026 to DarkBlinders, an Iran state-aligned actor active since at least September 2024. The campaign compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq.
Dream assesses with medium confidence that DarkBlinders is related to clusters tracked as UNC5795 and Dust Specter, and that those may in turn be sub-clusters of APT34, the long-running Iranian group also known as OilRig. Earlier phases of the activity were documented by Elastic Security Labs as REF8685, and by Group-IB and Palo Alto Networks' Unit 42. Recruitment-themed lures were first detected in late March 2026, with infrastructure staging possibly dating back to November 2025.
The tradecraft is aimed squarely at the IT workforce. Targets received spear-phishing with trojanised utilities hosted on attacker-controlled download sites, credential-harvesting pages on lookalike government, webmail and cloud domains, and a fake videoconferencing application called StarkMeet that launches the ShelbyLoader V2 and SHELBYC2 implants. One lure impersonated Dubai Airports recruiters and delivered a trojanised Visual Studio coding challenge whose malicious project file abused AppDomainManager injection and DLL sideloading. A tunnelling utility called Blackwood was deployed through SHELBYC2, and an earlier backdoor variant used GitHub for command and control.
The combination matters: a Gulf aviation employer as the lure, developers and job seekers as the targets, and a government cloud tenancy as the prize. It shows how the war has widened the aperture of Iranian cyber operations from Israeli and American targets to the wider regional ecosystem, and how cloud environments inherit the compromise of any developer who takes the bait.
Why it matters
Recruitment lures aimed at engineers are among the most effective routes into cloud estates because the victims have privileged credentials and are used to downloading unfamiliar code. The campaign is a reminder that state espionage during the Iran war is targeting the people who build and run IT, not only the systems they run.
Indicops view
Indian IT services firms and GCCs with Gulf clients are precisely the population this tradecraft is built for: large developer workforces, active recruitment pipelines and access to client cloud tenancies. We recommend treating coding challenges and interview software from unverified recruiters as untrusted code, enforcing phishing-resistant MFA on all cloud consoles, and monitoring for anomalous tunnelling from developer workstations. For government cloud programmes in India, the Kurdistan breach is a case study in why tenancy isolation and least privilege are not optional.
More in AI News
Back to the newsroomJensen Huang steps down as Nvidia CEO; CFO Colette Kress becomes interim chief
Nvidia's founder resigned as chief executive on 12 November after a board meeting, with CFO Colette Kress taking over on an interim basis while a search begins. The shares fell as much as 13 per cent, and quarterly results are due on 17 November.
Google adds TPU 8tx and 8i Max, taking its eighth-generation TPU family to four chips
Google has expanded its eighth-generation TPU line with TPU 8tx, for confidential inference and small-scale training, and TPU 8i Max, a dual-chip package for long-context inference. It also open-sourced TorchTPU and TPU Sync. Availability dates for the new chips were not given.
Iran-linked hackers sabotage refrigeration controllers across Israel, the US and Europe
NPR reports that a group calling itself Cyber Isnaad Front, which Israeli incident responders attribute to Iranian military hackers, has sabotaged industrial refrigeration systems from a food plant in Israel to roughly 300 French supermarkets and, in early November, retailers across six more European countries. Internet-exposed Danfoss controllers were a common entry point.