Search — “DarkBlinders”

An Iran state-aligned actor tracked as DarkBlinders ran an August–October 2026 espionage campaign, per a report from Dream Research Labs reported by The Hacker News. The source says the campaign compromised a high-profile individual in Israel and additional government cloud compromises in the Kurdistan Region of Iraq. Attacks rely on spear-phishing with trojanized utilities, credential-phishing lookalike domains, and a Visual Studio coding-challenge lure that uses .csproj AppDomainManager injection and DLL sideloading to run SHELBYLOADER and SHELBYC2. Hunters should look for DLL sideloading, AppDomainManager hijacking, and the listed lookalike domains.