A four-week-old Iranian espionage report is circulating this week as a 72-hour event

Dream Security’s research arm published “DarkBlinders: Inside an Active Espionage Campaign” on 8 October 2026; SOC Prime logged the indicators on 14 October. The Hacker News wrote it up on 2 November, CybersecurityNews republished on 3 November and CybelAngel aggregated around 4 November. The underlying research is substantial. Dream documents activity from August to October 2026 against targets in Israel and the Kurdistan Region of Iraq, including the compromise of a high-profile individual in Israel associated with the security sector and of a government cloud environment in Iraqi Kurdistan. Operator commands recovered by the researchers showed credential theft and the removal of at least 1 GB of data from the Iraqi government cloud, according to CybersecurityNews' 3 November summary of the Dream report.

The access was unusual. Dream reverse-engineered the loader behind a decoy application called StarkMeet, recovered an embedded GitHub personal access token and obtained read-only entry to the operators' own command-and-control, run from public repositories under the account PeakyBlindersTeam. That is why the report contains tasking rather than indicators alone. Implants write host reports to PeakyBlindersTeam/myLic listing machine name, user and domain, logon server, time zone, interface language, keyboard layouts, persistence status and anti-analysis findings. Lure infrastructure imitated Kuwait’s Ministry of Foreign Affairs and the GCC Secretariat General, across domains including gcc-sg[.]cloud, krgcloud[.]online and drive-g[.]cloud. Dream assesses with high confidence that the latest wave is Iranian, and medium-to-high confidence that it overlaps with the clusters tracked as UNC5795 and Dust Specter.

Assessment: Two things to hold apart. The first is the aggregation chain: a vendor report dated 8 October acquires a news cycle in November and is then read as current activity. Dream’s visibility came from read-only access to the actors' own GitHub C2, and publication burned it. Whether the operators rebuilt on a sixth repository after 8 October is unanswered by anyone. The second is attribution drift. Dream hedges at medium-to-high confidence on cluster overlap; CybelAngel’s framing — Iran-linked, not a settled connection to APT34 — is the correct one, and several write-ups this week have collapsed that distinction without flagging that they did.