MEFILES

Vendor traces Iran-nexus espionage to a Kurdistan government cloud and an Israeli target

Dream Research Labs says the campaign was still live when it published; ESET separately reports Iran-aligned groups coming out of a quiet phase. No government has confirmed either account.

Dream Research Labs, the research arm of Dream Security, published a report on an espionage campaign it says it observed between August and October 2026 and that was still active at publication. It attributes the activity to a group it calls DarkBlinders, assessed as Iran-state-aligned and operating since at least September 2024, previously linked to operations against aviation infrastructure and telecommunications in the UAE and Iraq. The Hacker News reported on 2 November that the campaign compromised a high-profile individual in Israel associated with the security sector and a government cloud environment in the Kurdistan Region of Iraq, from which more than a gigabyte of data was exfiltrated. The phishing infrastructure named in the report includes pages imitating Kuwait’s Ministry of Foreign Affairs and the GCC Secretariat General, across domains including mfakuwait[.]online and krgcloud[.]online. No KRG statement has been issued in response.

The tradecraft described is unusually disciplined. Victims were lured to StarkMeet, a fake video-conferencing application delivered through an unsigned Inno Setup installer labelled version 3.2; the decoy interface loads, the “Join” button always errors, and hidden components install to a separate folder that survives removal of the visible app. Persistence runs through a MicrosoftRuntime value in the current-user Run key. Command and control sat in GitHub repositories under an account named PeakyBlindersTeam, with a fallback that would read a hidden comment in the public Microsoft vscode repository for new configuration if the account were removed. Per the vendor summaries, roughly ten hosts registered initially but only two victims ever appeared in the second-stage tasking channel: operators reviewed metadata before issuing the decryption key.

The attribution is softer than the headlines. Dream links DarkBlinders to UNC5795 and Dust Specter at medium-to-high confidence; Elastic tracks the cluster as REF8685. Cryptika’s summary of the report states plainly that “the signs of an Iranian link are real but limited,” and The Hacker News notes the group exhibits no technical overlap with other known hacking groups. Separately, ESET’s APT Activity Report, dated 2 November from Jena, finds that after “a comparatively quiet phase” several Iran-aligned groups stepped up operations in the Middle East, with Israeli organisations across varied sectors the main focus and isolated US companies also hit. The same report places FilthyFeline at a mobile data services provider in Uzbekistan and Arid Viper, a Hamas-aligned actor, against Palestinian Authority institutions, apparently including the foreign ministry.

Assessment: Two things deserve separating. The intrusion set is well documented and partly checkable — a GitHub account either disappears or it does not, and the vscode fallback channel is observable. The state attribution is not: an actor with no technical overlap with known groups is, by definition, hard to place on a flag, and the vendors' own summarisers hedge more than their headlines do. The detail other desks will skip is the lure set. Impersonating Kuwait’s foreign ministry and the GCC Secretariat means the targeting envelope is Gulf diplomatic traffic, not only Israeli. Ten hosts and two selected victims is curation, not a spray — collection work, with a vendor as its only witness.

Apple’s 99-country spyware wave reaches Berlin — and the figure comes from a Beirut filmmaker’s screenshot

Germany’s BSI says it cannot determine whether the alerts reflect successful infections or attempted attacks. No vendor has been named and no state attributed.

Apple threat notifications began arriving on 29 October, according to Germany’s Federal Office for Information Security, the BSI, which wrote to Bundestag members the following day recommending protective measures and asking recipients to make contact. On 1 November the federal Digital Minister, Karsten Wildberger, confirmed on ARD’s Bericht aus Berlin that there had been “a notification from Apple that certain devices may have been compromised with so-called spyware”. The BSI told TechCrunch on 2 November that anyone receiving such a notification “should therefore assume that their device may have been compromised,” and said in its November advisory the following day that it cannot determine whether the alerts reflect successful infections or attempted attacks, and has not identified the recipients, the spyware, or those responsible. Apple has not disclosed how many individuals were notified; Euronews states the number is not known.

The 99-country figure, carried by TechCrunch, the Financial Times and 9to5Mac, does not come from an Apple press statement — there appears to be none. It rests on the notice received by Radwan Mortada, a Beirut-based filmmaker, who posted a screenshot of his alert on X; the text reproduced by IBTimes UK is truncated in every published version, reading that the notification is being sent to targeted users in 99 countries and that Apple has to date notified users in over 150 countries. Korben reported on 3 November that Mortada had been targeted with Pegasus in 2017 and again in 2021 and received this alert after the release of his documentary on the Hezbollah pager operation — a causal framing that is the outlet’s, not Mortada’s. TechCrunch notes that the best-known mercenary vendor is Israel’s NSO Group and that Germany’s BKA reportedly bought Pegasus access in 2019. Nobody has connected NSO to this wave.

Assessment: The story is being read in Berlin as a German political scandal. The sourcing says otherwise: the only quantified element of the wave entered public record through a Lebanese journalist’s phone, which is a fair description of how mercenary-spyware reporting has worked for a decade. Hold two lines. A notification is a notification, not a confirmed infection, and the BSI says so in writing. And an unattributed wave is unattributed — the vendor name, if one emerges, will come from Citizen Lab or Amnesty’s Security Lab forensics on a recipient device, not from Apple. Watch whether anyone else in Lebanon, Jordan, Morocco or the Gulf comes forward.

Researchers trace a three-year anti-Muslim ad operation to Israel-based entities, then decline to blame the state

Marc Owen Jones and Sohan Dsouza estimate £6.12 million in spend and 800 million exposures across 30-plus countries. Meta’s own 2024 enforcement captured about a sixth of that spend.

The report, titled Manufacturing The Great Replacement and first reported by The National, documents a campaign the researchers say ran from October 2023 to October 2026 across more than 30 countries in Europe, the Americas, Asia and the Middle East. The content was anti-Muslim and anti-migrant, and also anti-Qatar and anti-Iran, delivered through paid social advertising, AI-generated video, music, video-game parodies and repurposed footage; one sub-campaign titled “Grand Theft Qatar” depicted Emiratis buying European buildings and converting them to mosques. Jones and Dsouza count 1,473 Facebook advertisements, 189 YouTube videos, 359 TikTok advertisements and 105 TikTok account videos, estimating total spend at £6.12 million, or $8.2 million, and roughly 800 million advertising exposures. Meta acknowledged in 2024 that the operation had spent £900,000 on ads across its platforms — about 15 per cent of the figure the researchers now estimate.

The infrastructure trail is the contested part. The researchers say initial operations were traced to Israel via Vietnamese proxy companies, that the operation resurfaced in November after Meta enforcement in May 2024, and that it later shifted to Brazilian corporate entities. One video creator known as ShukiD was linked through metadata to campaign content and had previously worked on political campaigns in occupied territories. Activity continued through Germany’s Saxony-Anhalt regional election in September 2026 and remained live in France and Italy ahead of 2027 votes. Dsouza told The National: “We can’t really assert that it definitely is Israel. But the evidence shows that the entities involved in this operation are based in Israel and have connections to influence operations run by the Israeli government.” Most downstream coverage — Anadolu, TRT World, Shafaqna, Middle East Monitor — carries the finding without the caveat.

Assessment: Strip the amplification and what is independently corroborated narrows to one thing: Meta found and acted on part of this in 2024 and put a number on it. The Vietnamese and Brazilian corporate layers rest entirely on the researchers' own tracing, and a confidence level of “moderate to high” circulating via Shafaqna does not appear in the English-language originals. Note which outlets dropped the hedge — Turkish state-adjacent and Iran-adjacent ones, with obvious incentives. The same mechanism is running this week around an anonymous Telegraph claim that Tehran plans US election-day disruption, laundered through a post on X into partisan American copy. The test of the report is whether Meta, Google or TikTok respond at all.