Threat intel

Dream Research Labs has published an analysis of DarkBlinders, a suspected Iran-nexus espionage group, covering a campaign it watched from August to October 2026 against targets in Israel and the Kurdistan Region of Iraq. The confirmed victims are a high-profile individual in Israel tied to the security sector and a government cloud environment in the Kurdistan Region, from which the operators stole credentials and at least 1 GB of data. Dream says the campaign was still active when it published.

The tradecraft is aimed at government and diplomatic staff: lookalike Outlook Web App (OWA) login pages, fake Google Drive share links and a fake video-meeting app called StarkMeet. If your users work with Gulf, Iraqi or Kurdish government bodies, or your organisation hosts mail and files for one, the domains and host artefacts below are worth checking today.

How it works

The group runs two kinds of lure side by side. The first is plain credential phishing. Some pages copied the OWA sign-in screen and posed as the Kuwaiti Ministry of Foreign Affairs and the Gulf Cooperation Council (GCC) Secretariat General, on domains such as gcc-sg[.]cloud and mfakuwait[.]online. They collected only a username and password. Others imitated a Google Drive share on Kurdistan government-themed domains such as moelcloud[.]online, claiming a ZIP file could not be previewed and had to be downloaded.

The second lure is StarkMeet, a fake meeting app with a normal setup wizard whose Join button always fails. Dream did not recover the message that delivered StarkMeet.zip. The installer puts the decoy under %LOCALAPPDATA%\StarkMeet and the real payload under %LOCALAPPDATA%\Microsoft\RuntimeBroker, where a legitimately signed .NET host (vshost.exe, renamed RuntimeBroker.exe) loads a malicious RuntimeBroker.dll through AppDomainManager injection. That technique abuses a .NET setting that tells a program to load an extra assembly at startup, so trusted signed code ends up running the attacker's DLL. Persistence is a MicrosoftRuntime value in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Uninstalling StarkMeet leaves all of this in place.

Command and control runs through GitHub. The loader writes a report on the host (user name, machine name, domain, keyboard layout) to a repository called PeakyBlindersTeam/myLic over api.github.com. An operator reads it and decides whether the host deserves the second stage. Chosen hosts receive the backdoor, which polls a second repository, PeakyBlindersTeam/myCode, for commands about every 63 seconds. It runs PowerShell inside its own process, so powershell.exe never starts, and it uploads and downloads files.

Two fallbacks keep the channel alive if GitHub removes the account. A Cloudflare Worker at g-prx.itugegape524.workers[.]dev acts as a relay, and the implant can read new account and token settings from a hidden comment posted on the public Microsoft vscode repository. Blocking one GitHub account therefore does not cut off an infected host.

What attackers are doing

Dream gained read-only access to the GitHub repositories. About ten hosts registered in myLic, but only two victims appeared in the myCode tasking channel, which points to an operator picking targets by hand. Recovered commands show credential theft and the removal of at least 1 GB from the Iraqi government cloud environment.

The report does not say how the cloud environment itself was entered. It does not mention Microsoft 365, Google Workspace, token theft or a multi-factor authentication (MFA) bypass. What is documented is phished webmail passwords on one side and an implant that runs PowerShell and moves files on the other, and either can reach cloud data from a user's account. Treat the exact route as unknown.

DarkBlinders has been active since at least September 2024 and earlier hit aviation and telecom targets in the UAE and Iraq, including a fake Dubai Airports coding test that Palo Alto Networks Unit 42 tracked as Blinder Tunnel. Dream places the group in the same cluster as UNC5795 and Dust Specter with medium-to-high confidence, and assesses with medium confidence that these may be subclusters of APT34 (also called OilRig). The Iranian link is circumstantial: the first test machine to check in used a Persian keyboard layout, and one StarkMeet domain used ParsVDS name servers. Dream says neither proves who the operators are.

What to do

Block the infrastructure narrowly. Add the lure domains to DNS and proxy blocklists: gcc-sg[.]cloud, mfakuwait[.]online, moelcloud[.]online, stark-meet[.]com, stark-meet[.]online and stark-meet[.]website. For GitHub, match the exact repository paths /repos/PeakyBlindersTeam/myLic and /repos/PeakyBlindersTeam/myCode and the Worker hostname. Blocking all of api.github.com or workers.dev breaks developer tools and is unnecessary.

Search back for visits. Query DNS and proxy logs from August 2026 onward for those domains. Every user who loaded one of the OWA or Drive pages should be treated as having typed their password into it, and every machine that fetched a StarkMeet download goes to the endpoint hunt.

Hunt Windows hosts. Look for a MicrosoftRuntime value under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, for any file under %LOCALAPPDATA%\Microsoft\RuntimeBroker, and for RuntimeBroker.exe running from anywhere other than C:\Windows\System32. In your EDR, flag processes that load System.Management.Automation.dll without being PowerShell, and non-developer machines making regular calls to api.github.com at roughly one-minute intervals.

Audit the cloud accounts of exposed users. For each person identified above, pull the sign-in log for the webmail and cloud tenant they use (in Microsoft Entra, Sign-in logs filtered by user; in Google Workspace, the Login audit) and look for successful sign-ins from unfamiliar IP addresses or countries after their visit to the lure. Then check the file and mail audit logs for bulk downloads or large exports from their account, since the documented loss is at least 1 GB. Dream does not describe inbox rules, mail forwarding or OAuth app consents in this campaign, so anything you find there is a separate lead, not a known DarkBlinders trait.

Clean up in the right order. Isolate and reimage any host with the RuntimeBroker artefacts, since deleting the Run key alone leaves the DLLs on disk. Then reset the user's password, revoke their active sessions so existing tokens stop working, and require MFA for webmail and file-sharing sign-ins. Passwords phished through an OWA page work anywhere that still accepts a password alone.

The wider lesson

This campaign uses services most companies trust by default: GitHub for control, Cloudflare Workers for relay, and a signed Microsoft binary for execution. Allow-lists by domain or signer will not catch it. Detection has to rest on behaviour: a meeting app installing files under a Microsoft folder in the user profile, a Run key with a Microsoft-sounding name, and a workstation that polls a GitHub repository every minute.

If you want an outside check of how your cloud tenant would show a phished login and a bulk download, our cloud and Kubernetes security work covers sign-in and audit log configuration, and security operations can run the endpoint and identity hunt above. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Dream Research Labs, The Hacker News, GBHackers, Cyber Press, Cryptika, SOC Prime.