An espionage campaign phishing with Gulf webmail lures took a gigabyte from a Kurdistan government cloud

The Israeli vendor Dream Security says it observed the campaign it calls DarkBlinders between August and October 2026, and that the operation remained active at publication. Confirmed activity includes credential theft and the exfiltration of at least one gigabyte from a government cloud environment in Iraqi Kurdistan, alongside the compromise of a high-profile Israeli individual associated with the security sector. The tradecraft described is patient rather than noisy: impersonation of government webmail, cloud-drive and meeting services to establish access, then a review of infected systems before a second-stage implant was selectively deployed. Some lures copied Google Drive sharing links on domains themed around the Kurdistan Regional Government. For resilience, the malware could read a hidden comment in the public Microsoft vscode repository to locate new infrastructure if GitHub shut down its account.

The indicators published include gcc-sg[.]cloud and gcc-sg[.]online as Gulf Cooperation Council webmail lures, and drive-g[.]cloud, cdndrive[.]online, cdn-gdrive[.]cloud and drive-go[.]cam for Drive-style delivery. On attribution Dream hedges, and the hedge should travel with the finding: medium-to-high confidence that DarkBlinders overlaps with UNC5795 and Dust Specter, and only medium confidence on possible relationships with UNC5187 within APT34, on the basis of shared servers, matching malware and a common focus on Iraqi government targets. Dream positions the operation as an extension of the activity behind Unit 42’s previously documented Blinder Tunnel campaign, which recorded fake Dubai Airports recruitment lures and abuse of the GitHub API. This desk did not obtain the primary Dream report; the details above come from trade secondaries.

Assessment: Single-vendor research naming a new actor is a commercial act as well as a technical one, and Israeli vendors publishing on Iranian-nexus clusters have an obvious market. That does not make the indicators wrong — domains and GitHub fallback channels are checkable by anyone, and the Gulf-branded webmail lures are the operationally useful part regardless of which cluster label survives. The APT34 link is the weakest claim in the package and is where secondary coverage will harden the hedge into a fact. Two things to watch: whether GitHub disables the C2 accounts given the vscode-repository fallback, and whether activity continues after disclosure. A campaign that keeps running after being named was never relying on stealth.