VULNpocalypse
MediumBreach / campaignMonitoring

DarkBlinders campaign reported to hit Kurdistan government cloud, Dream says

Researchers at Dream report an Iran-linked group stole data from a Kurdistan government cloud via phishing and a fake StarkMeet app; check for its IoCs.

Published
Exploitation
Not confirmed by the victim, Cyber Security News reports Dream saw credential theft and data removal in recovered attacker commands

What happened

Cyber Security News reports, based on research by Dream, that an Iran-linked group Dream calls DarkBlinders broke into a government cloud system in the Kurdistan Region of Iraq and removed at least 1 GB of data Cyber Security News. According to the same report, the group also compromised a high-profile person in Israel who works in the security sector, and the campaign ran from August to October 2026 and was still active when reported Cyber Security News.

What is not confirmed: the affected Kurdistan government body has not confirmed the incident in the sources, the claims have not been independently verified beyond Dream’s research, and the identity of the Israeli victim is not stated.

Cyber Security News describes the reported methods as follows Cyber Security News:

  • Credential phishing: fake Outlook Web App pages posing as the Kuwait Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General, which collected usernames and passwords.
  • Fake Google Drive pages: on Kurdistan Regional Government themed domains, telling victims a ZIP could not be previewed and must be downloaded.
  • Fake meeting app “StarkMeet”: a decoy installer whose Join button always failed, while hidden files were installed in a separate folder and kept running even after StarkMeet was removed.
  • GitHub used for command and control: the malware sent host details to a GitHub repository, and only victims chosen by the operator received the key to unlock a second-stage backdoor. About ten systems checked in, but only two victims appeared in the tasking channel.
  • Backdoor capabilities: running PowerShell commands inside its own process without starting powershell.exe, and uploading and downloading files. As a fallback, it could read a hidden comment in the public Microsoft vscode repository to find new settings.

Dream reverse-engineered the malware and says it gained read-only access to the attacker’s command servers. Recovered commands showed credential theft and the removal of at least 1 GB of data, per the report Cyber Security News.

Attribution: According to Cyber Security News, Dream links DarkBlinders to UNC5795 and Dust Specter with medium-to-high confidence. With medium confidence, it says this cluster and UNC5187 may be related subclusters of APT34. The cited evidence is shared servers, matching malware and a focus on Iraqi government targets. Dream calls the signs of an Iranian link “real but limited”: a first check-in host with a Persian keyboard layout and a decoy domain using ParsVDS name servers. Dream says neither fact proves the operator’s identity on its own Cyber Security News. The report also says the same actor is behind the earlier Blinder Tunnel campaign documented by Unit 42, which used a Dubai Airports coding test lure.

No CVE or software vulnerability is named in the source.

Am I affected?

You may be affected if any of these apply, based on the indicators in the report Cyber Security News:

  • Users entered credentials on login pages imitating the Kuwait Ministry of Foreign Affairs, the GCC Secretariat General or Kurdistan government services.
  • StarkMeet was installed on any endpoint, even if it was later uninstalled.
  • Endpoints made GitHub API calls to the PeakyBlindersTeam/myLic or PeakyBlindersTeam/myCode repositories.
  • Network logs show contact with lure domains such as gcc-sg[.]cloud, mfakuwait[.]org, krgcloud[.]online, starkmeet[.]com, stark-meet[.]com, drive-g[.]cloud or meetgooge[.]online, or with the Cloudflare Worker g-prx.itugegape524.workers[.]dev.
  • Connections to the listed IPs, including 194.62.249[.]114, 89.125.209[.]80 or 77.223.215[.]140.

The full domain, IP and file hash list is in the source article.

What to do now

  1. Import the indicators from the Cyber Security News report into your threat intelligence platform or SIEM, and keep them defanged outside those tools.
  2. Hunt for StarkMeet installers, leftover hidden components and the listed file hashes on endpoints. Remember that the report says the hidden files persist after StarkMeet is removed.
  3. Review GitHub traffic that does not match normal developer work, especially API requests to the PeakyBlindersTeam repositories.
  4. Look for PowerShell activity in unusual processes. The report says the backdoor did not spawn powershell.exe.
  5. If you find credential entry on a lure page, reset the affected accounts and review email, shared files and linked cloud services for access. The report notes that stolen logins can open these without triggering a malware alert.
  6. Per the report, block only the exact GitHub accounts and Cloudflare paths listed, not the whole services Cyber Security News.

Sources