DarkBlinders campaign used fake Kuwaiti and GCC portals to phish Gulf officials

Research published around 2–3 November describes a group tracked as DarkBlinders operating from August to October 2026 and still active at the time of reporting. According to the vendor Dream, as summarised by CybelAngel and others, the actor compromised a government cloud environment in Iraq’s Kurdistan Region and a high-profile individual in Israel’s security sector, with recovered commands showing credential theft and the removal of at least 1 GB of data from the Iraqi government cloud. The tradecraft is patient rather than loud: lookalike government, webmail and cloud login pages, and a fake video-meeting application called StarkMeet that installed a loader and backdoor in a separate folder that survived removal of the decoy. Victim details were posted to a GitHub repository the operator reviewed by hand; roughly ten systems beaconed, but only two were actively tasked. The backdoor ran PowerShell inside its own process, never launching powershell.exe.

The targeting is what makes this a Gulf item. The lure infrastructure imitated Kuwait’s Ministry of Foreign Affairs and the GCC Secretariat General, with indicators including gcc-sg[.]cloud and gcc-sg[.]online alongside Kurdistan-themed domains such as krgcloud[.]online and moelcloud[.]online and Drive-style delivery hosts. CybelAngel advises government, diplomatic and critical infrastructure teams in the Gulf to review webmail sign-ins and cloud storage access for unexplained activity. The attribution, however, is contested across the three vendors handling the same intrusion set. Dream links DarkBlinders to UNC5795 and Dust Specter with medium-to-high confidence on shared servers, matching malware and a common focus on Iraqi government targets, and draws a broader line to APT34 with medium confidence. Group-IB, which named the set, assesses the Iran link with low confidence and found no technical overlap with known groups.

Assessment: This is vendor research, not an intelligence finding, and the desk could not reach Dream’s or Group-IB’s primary publications — four secondary write-ups is a weak base for a claim about a sovereign government’s cloud. No Kurdish, Kuwaiti or Israeli official has commented on the record. The useful signal is the spread in confidence levels: the same artefacts yield medium-to-high APT34 adjacency from one shop and low-confidence Iran attribution from another, which is how a hedged finding becomes a headline nationality on its third republication. Read it alongside the freezer file. In both, the technical reporting is reasonably firm and the flag attached to it is the softest part of the package.