Iran-Linked DarkBlinders Group Uses Fake Job Offers and Phishing to Breach Government Cloud and High-Profile Target

Researchers at Dream Research Labs have detailed a cyber espionage campaign by an Iran state-aligned group known as DarkBlinders. Between August and October 2026, the group targeted Israel and the Kurdistan Region of Iraq. The campaign led to the compromise of a high-profile individual in Israel and affected a government cloud environment in the Kurdistan Region.

DarkBlinders is believed to have been active since at least September 2024 and has been linked to attacks on aviation and telecommunications in the U.A.E. and Iraq. Its attacks typically begin with spear-phishing, where recipients are lured into opening trojanized utilities or visiting attacker-controlled websites that offer similar tools for download. Earlier attacks documented by Elastic Security Labs and Group-IB involved malware that used GitHub for command and control, data theft and remote access.

Palo Alto Networks also described a related campaign in which the group posed as the Dubai Airports IT department. Targets were approached with attractive job offers and asked to run an application that looked like a career portal and included a questionnaire. The questionnaire was a harmless decoy designed to build trust before a Microsoft Visual Studio project, disguised as a coding assessment, delivered the malware. Attackers appear to have been preparing their infrastructure since November 2025. This summary is based on the opening section of the source article only.