DarkBlinders Isroilning xavfsizlik sohasiga aloqador yuqori darajadagi shaxsni va Iroq Kurdistonidagi hukumat bulut muhitini buzib kirgan, bu jarayonda hisob ma'lumotlarini o'g'irlash, soxta uchrashuv ilovasi va GitHub-ga asoslangan orqa eshiklardan foydalangan.
Dream Security 2026-yil avgust va oktyabr oylari orasida kuzatilgan kiberjosuslik kampaniyasini kuzatgan va nashr etilgan paytda u hali ham faol ekanligini xabar qilgan.
Tasdiqlangan faoliyatga hisob ma'lumotlarini o'g'irlash va hukumat muhitidan kamida 1 GB ma'lumotni o'g'irlab chiqarish kirgan.
Operatsiya Unit 42 tomonidan avvalroq hujjatlashtirilgan Blinder Tunnel kampaniyasi ortidagi faoliyatni kengaytiradi.
Hujumchilar kirish huquqini olish uchun hukumat veb-pochtasi, bulut-disk va uchrashuv xizmati niqobini ishlatgan, so'ngra zararlangan tizimlarni ko'rib chiqqan va ikkinchi bosqich implantini tanlab joylashtirgan.
Bu tanlovchanlik dastlabki infeksiyalarni operatsion ekspluatatsiya uchun tanlangan tizimlardan ajratib turdi.
Uning interfeysi mahalliy kamera, mikrofon va ekran ulashish oldindan ko'rinishlarini taklif qilgan, ammo uchrashuvga qo'shilish har doim doimiy ulanish xatosini qaytargan.
Tadqiqotchilar soxta ilova ichida hech qanday tarmoq yoki yukni joylashtirish funksiyasini topmagan.
Buning o'rniga o'rnatuvchi alohida zararli komponentlarni %LOCALAPPDATA%\Microsoft\RuntimeBroker ostiga joylashtirgan.
Qonuniy, imzolangan vshost.exe, RuntimeBroker.exe deb qayta nomlangan, RuntimeBroker.dll ni AppDomainManager-ga asoslangan mexanizm orqali yuklagan.
RuntimeBroker.dll tahlilidan tiklangan operator topshiriqlariga tadqiqot ish oqimi (Manba: Dream Security).
Doimiylik joriy foydalanuvchining Run ro'yxat kalitidagi MicrosoftRuntime qiymatiga tayangan, bu zararli tarmoqning ko'rinadigan ilova o'chirilishidan keyin ham saqlanib qolishiga imkon bergan.
Dream Security kuzatishicha, StarkMeet video-uchrashuv ilovasi sifatida niqoblangan, 3.2 versiyasi deb belgilangan imzolanmagan Inno Setup o'rnatuvchidan foydalangan.
DarkBlinders APT Hujumi
Parallel fishing sahifalari Quvayt Tashqi ishlar vazirligi va Ko'rfaz hamkorlik kengashi Bosh kotibiyatini taqlid qilgan.
Outlook Web App o'xshashlari hisob ma'lumotlarini yig'gan, Google Drive uslubidagi sahifalar esa hujumchi nazoratidagi arxivlarni yuklab olishni rag'batlantirgan.
StarkMeet.zip ni yetkazgan asl xabar tiklanmagan, bu uning aniq yetkazish yo'lini tasdiqlanmagan holda qoldirgan.
StarkMeet o'rnatuvchisi va soxta uchrashuv interfeysi (Manba: Dream Security).
Yuklovchi jabrlanuvchilarni PeakyBlindersTeam/myLic omborida ro'yxatdan o'tkazish uchun o'rnatilgan GitHub shaxsiy kirish tokenidan foydalangan.
Hisobotlar foydalanuvchi nomlari, domenlar, klaviatura tartiblari, doimiylik holati va anti-tahlil natijalarini ochib bergan. Bu tekshiruvlar operator qarorlarini ma'lum qilgan, avtomatik ravishda bajarishni to'xtatmagan.
Taxminan o'n ta xost ro'yxatdan o'tgan, ammo tadqiqotchilar ikkinchi bosqich topshiriq omborida faqat ikkita jabrlanuvchini aniqlagan. Tanlangan tizimlar RuntimeBrokerApi.dll ni ochadigan xostga xos faollashtirish materialini olgan.
Yuklovchi AES-256-CBC kalitini litsenziya qatorining SHA-256 xeshidan hosil qilgan va birinchi 16 kalit baytini boshlang'ich vektor sifatida ishlatgan.
Shifrlangan yig'ilish to'g'ridan-to'g'ri xotirada ishlagan va myCode orqali aloqa qilgan, taxminan har 63 soniyada buyruqlarni tekshirgan.
O'rnatilgan PsProxy.dll System.Management.Automation runspacelari orqali powershell.exe ni ishga tushirmasdan PowerShell ni bajargan, bu bolalar jarayoni aniqlashga bog'liq bo'lgan aniqlashlar uchun ko'rinishni kamaytirgan.
Qo'shimcha buyruqlar fayl yuklash, yuklab olish va ZIP ochishni qo'llab-quvvatlagan.
Soatlik tiklanish mexanizmi shifrlangan konfiguratsiyani izohlar ichida yashiringan holda topish uchun ommaviy Microsoft/vscode muammolarini qidirgan.
Yaroqli ko'rsatmalar ombor egaligini, ombor nomlarini va tokenlarni almashtirishi mumkin edi, bu asosiy hisob ma'lumotlari ishlamay qolganda tiklanish yo'lini ta'minlagan.
Dream GitHub commit tarixidan tarixiy litsenziya materialini tiklagan, yukni shifrlagan va operator topshiriqlarini faqat o'qish huquqi bilan tekshirgan.
Dream DarkBlinders UNC5795 va Dust Specter bilan o'rta-yuqori ishonch bilan mos kelishini baholagan, shu bilan birga APT34 ichidagi UNC5187 bilan mumkin bo'lgan aloqalarga o'rta ishonch bergan.
Alohida, Unit 42 ning Blinder Tunnel tadqiqoti soxta Dubay aeroportlari ishga yollash vasvasalari va GitHub API suiiste'molini hujjatlashtirgan, bu kiberjosuslik aloqalarini odatiy bulut trafigi sifatida niqoblashning kengroq naqshini mustahkamlagan, bu nishonga olingan Yaqin Sharq korporativ tarmoqlari bo'ylab kuzatilgan.
IOC lar
| Domen | Tavsif | Nishon yoki rol |
|---|---|---|
gcc-sg[.]cloud | GCC Bosh kotibiyat bulut va veb-pochta vasvasasi | GCC va Ko'rfaz diplomatiyasi |
gcc-sg[.]online | GCC Bosh kotibiyat veb-pochta vasvasasi | GCC va Ko'rfaz diplomatiyasi |
mfakuwait[.]org | Quvayt Tashqi ishlar Outlook fishingi | Quvayt |
Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.
DarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors.
Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication.
Confirmed activity included credential theft and the exfiltration of at least 1 GB from the government environment.
The operation extends the activity behind Unit 42’s previously documented Blinder Tunnel campaign.
Attackers used government webmail, cloud-drive, and meeting-service impersonation to establish access, then reviewed infected systems before selectively deploying a second-stage implant.
This selectivity separated initial infections from systems chosen for operational exploitation.
Its interface offered local camera, microphone, and screen-sharing previews, but joining a meeting always returned a fixed connection error.
Researchers found no networking or payload-deployment functionality within the decoy application itself.
Instead, the installer placed separate malicious components under %LOCALAPPDATA%\Microsoft\RuntimeBroker.
A legitimate, signed vshost.exe, renamed RuntimeBroker.exe, loaded RuntimeBroker.dll through an AppDomainManager-based mechanism.
Research workflow from RuntimeBroker.dll analysis to recovered operator tasking (Source : Dream Security).
Persistence relied on the MicrosoftRuntime value in the current user’s Run registry key, allowing the malicious branch to survive removal of the visible application.
Dream Security observed that, StarkMeet masqueraded as a video-meeting application, using an unsigned Inno Setup installer labeled version 3.2.
DarkBlinders APT Attack
Parallel phishing pages impersonated Kuwait’s Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General.
Outlook Web App lookalikes harvested credentials, while Google Drive-style pages encouraged downloads of attacker-controlled archives.
The original message delivering StarkMeet.zip was not recovered, leaving its precise delivery route unconfirmed.
StarkMeet installer and decoy meeting interface (Source : Dream Security).
The loader used an embedded GitHub personal access token to register victims in the PeakyBlindersTeam/myLic repository.
Reports exposed usernames, domains, keyboard layouts, persistence status, and anti-analysis findings. These checks informed operator decisions rather than automatically terminating execution.
Approximately ten hosts registered, but researchers identified only two victims in the second-stage tasking repository. Selected systems received host-specific activation material that unlocked RuntimeBrokerApi.dll.
The loader derived an AES-256-CBC key from the license string’s SHA-256 hash and used the first 16 key bytes as the initialization vector.
The decrypted assembly ran directly in memory and communicated through myCode, polling for commands approximately every 63 seconds.
An embedded PsProxy.dll executed PowerShell through System.Management.Automation runspaces without launching powershell.exe, reducing visibility for detections dependent on that child process.
Additional commands supported file uploads, downloads, and ZIP extraction.
An hourly recovery mechanism searched public Microsoft/vscode issues for encrypted configuration hidden inside comments.
Valid instructions could replace repository ownership, repository names, and tokens, providing a recovery path when primary credentials failed.
Dream recovered historical license material from GitHub commit history, decrypted the payload, and examined operator tasking through strictly read-only access.
Dream assessed medium-to-high confidence that DarkBlinders overlaps with UNC5795 and Dust Specter, while assigning medium confidence to possible relationships with UNC5187 within APT34.
Separately, Unit 42’s Blinder Tunnel research documented fake Dubai Airports recruitment lures and GitHub API abuse, reinforcing the broader pattern of disguising espionage communications as routine cloud traffic across targeted Middle Eastern enterprise networks.
IOCs
| Domain | Description | Target or role |
|---|---|---|
gcc-sg[.]cloud | GCC Secretariat General cloud and webmail lure | GCC and Gulf diplomacy |
gcc-sg[.]online | GCC Secretariat General webmail lure | GCC and Gulf diplomacy |
mfakuwait[.]org | Kuwait Foreign Affairs Outlook phishing | Kuwait |
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.