Vendor traces Iran-nexus espionage to a Kurdistan government cloud and an Israeli target

Dream Research Labs, the research arm of Dream Security, published a report on an espionage campaign it says it observed between August and October 2026 and that was still active at publication. It attributes the activity to a group it calls DarkBlinders, assessed as Iran-state-aligned and operating since at least September 2024, previously linked to operations against aviation infrastructure and telecommunications in the UAE and Iraq. The Hacker News reported on 2 November that the campaign compromised a high-profile individual in Israel associated with the security sector and a government cloud environment in the Kurdistan Region of Iraq, from which more than a gigabyte of data was exfiltrated. The phishing infrastructure named in the report includes pages imitating Kuwait’s Ministry of Foreign Affairs and the GCC Secretariat General, across domains including mfakuwait[.]online and krgcloud[.]online. No KRG statement has been issued in response.

The tradecraft described is unusually disciplined. Victims were lured to StarkMeet, a fake video-conferencing application delivered through an unsigned Inno Setup installer labelled version 3.2; the decoy interface loads, the “Join” button always errors, and hidden components install to a separate folder that survives removal of the visible app. Persistence runs through a MicrosoftRuntime value in the current-user Run key. Command and control sat in GitHub repositories under an account named PeakyBlindersTeam, with a fallback that would read a hidden comment in the public Microsoft vscode repository for new configuration if the account were removed. Per the vendor summaries, roughly ten hosts registered initially but only two victims ever appeared in the second-stage tasking channel: operators reviewed metadata before issuing the decryption key.

The attribution is softer than the headlines. Dream links DarkBlinders to UNC5795 and Dust Specter at medium-to-high confidence; Elastic tracks the cluster as REF8685. Cryptika’s summary of the report states plainly that “the signs of an Iranian link are real but limited,” and The Hacker News notes the group exhibits no technical overlap with other known hacking groups. Separately, ESET’s APT Activity Report, dated 2 November from Jena, finds that after “a comparatively quiet phase” several Iran-aligned groups stepped up operations in the Middle East, with Israeli organisations across varied sectors the main focus and isolated US companies also hit. The same report places FilthyFeline at a mobile data services provider in Uzbekistan and Arid Viper, a Hamas-aligned actor, against Palestinian Authority institutions, apparently including the foreign ministry.

Assessment: Two things deserve separating. The intrusion set is well documented and partly checkable — a GitHub account either disappears or it does not, and the vscode fallback channel is observable. The state attribution is not: an actor with no technical overlap with known groups is, by definition, hard to place on a flag, and the vendors' own summarisers hedge more than their headlines do. The detail other desks will skip is the lure set. Impersonating Kuwait’s foreign ministry and the GCC Secretariat means the targeting envelope is Gulf diplomatic traffic, not only Israeli. Ten hosts and two selected victims is curation, not a spray — collection work, with a vendor as its only witness.