Cybersecurity
Researchers detail DarkBlinders campaign and Prince of Persia C2
Dream Research Labs said DarkBlinders targeted Israel and the Kurdistan Region of Iraq between August and October 2026, while Semperis said Prince of Persia ran a server from the United States this year.
- Dream Research Labs said DarkBlinders ran a campaign from August through October 2026 against Israel and the Kurdistan Region of Iraq.
- It said one compromise involved an Israeli individual and another reached a cloud environment used by the region's government.
- The report said the group used spear-phishing and altered downloads, and earlier chains delivered SHELBYLOADER and SHELBYC2.
- Palo Alto Networks said a related Blinder Tunnel campaign impersonated Dubai Airports, while Dream linked the activity to UNC5795, Dust Specter and APT34.
- Semperis said Prince of Persia ran a C2 server from the United States this year, and Tomer Bar said the victim count stayed low.
Dream Research Labs said DarkBlinders ran an espionage campaign from August through October 2026 against Israel and the Kurdistan Region of Iraq. It said one compromise involved an Israeli individual and another reached a cloud environment used by the region's government.
Dream described DarkBlinders as an Iran-linked group active since at least September 2024. It said the group used spear-phishing to persuade victims to open altered utilities or download tools from attacker-run sites.
Earlier chains described by Elastic Security Labs and Group-IB delivered SHELBYLOADER and SHELBYC2, and Elastic tracked the cluster as REF8685. Palo Alto Networks later said the same actor used a Blinder Tunnel campaign, posing as Dubai Airports and sending malware-laced coding challenges.
Dream said the recruitment campaign was first seen in late March 2026 and that there were signs of infrastructure testing from November 2025. It said the chain used a .csproj file, AppDomainManager injection, DLL sideloading and the Blackwood tunnelling tool.
Dream also linked the activity to UNC5795, Dust Specter and APT34, and it listed lookalike domains and a fake videoconferencing app called StarkMeet. Separately, Semperis said Prince of Persia ran a U.S.-hosted C2 server this year, and Tomer Bar said victim numbers were low.
Named in this story
People
- Tomer Bar
- said victim numbers remained low
Companies
- Palo Alto Networks
- disclosed the Blinder Tunnel campaign
- Semperis
- observed Prince of Persia's C2 server
Organisations
- DarkBlinders
- Iran-linked group attributed with the campaign
- Dream Research Labs
- published the report on the campaign
- Unit 42
- said the attackers posed as Dubai Airports recruiters
- Dubai Airports
- was impersonated by the attackers
- UNC5795
- cluster Dream said overlapped with DarkBlinders
- Dust Specter
- another cluster Dream linked to the activity
- APT34
- broader group Dream said the clusters may belong to
- Prince of Persia (aka Infy)
- Iranian government-sponsored group tied to the U.S.-hosted C2 server
Products and systems
- SHELBYLOADER (aka HOTAIR)
- loader used in the earlier attack chain
- SHELBYC2 (aka AEROSTAT)
- backdoor launched by the loader
- Blackwood
- tunnelling utility delivered through SHELBYC2
- StarkMeet
- fake videoconferencing app used for malware delivery
- Tornado
- second-stage C2 server associated with Tonnerre
- Tonnerre
- variant that dropped Tornado via one-day vulnerabilities
Places
- Israel
- one of the targeted places
- Kurdistan Region of Iraq
- site of the compromised government cloud environment
How the source tells it
Mostly technical reporting, with only light framing from the cited researchers.
No emotive framing was found in the original.