Kiberxavfsizlik tadqiqotchilari 2026-yil avgust va oktyabr oylari orasida Eron davlatiga bog'liq tahdid aktori tomonidan Isroil va Iroq Kurdiston mintaqasiga qaratilgan kiberjosuslik kampaniyasi tafsilotlarini e'lon qilishdi.
Dream Research Labs tomonidan chop etilgan hisobotga ko'ra, kampaniya Isroildagi yuqori darajali shaxsning buzib kirilishiga, shuningdek, Kurdiston mintaqasidagi hukumat bulut muhitiga ta'sir qilgan qo'shimcha buzilishlarga olib kelgan.
Faoliyat DarkBlinders deb nomlanuvchi tahdid aktoriga bog'langan — bu Eron bilan bog'liq guruh kamida 2024-yil sentyabridan beri faol deb baholanadi va BAA hamda Iroqdagi aviatsiya infratuzilmasi va telekommunikatsiyalarga qaratilgan hujumlar bilan bog'liq. U boshqa ma'lum xaker guruhlari bilan texnik o'xshashlikka ega emas.
Guruh tomonidan amalga oshirilgan hujumlar dastlabki kirish yo'li sifatida spear-phishingdan foydalanishi ma'lum — qabul qiluvchilarni trojanlashtirilgan yordamchi dasturlarni ochishga yoki hujumchi nazoratidagi veb-saytlarga kirib, u yerda to'g'ridan-to'g'ri yuklab olish mumkin bo'lgan shunga o'xshash vositalarni bosishga jalb qiladi.
Elastic Security Labs va Group-IB tomonidan avval hujjatlashtirilgan hujum zanjirlari SHELBYLOADER (aka HOTAIR) joylashtirilishiga olib kelgan — u DLL sideloading orqali ishga tushiriladi va oxir-oqibat SHELBYC2 (aka AEROSTAT) deb nomlanuvchi backdoorni ishga tushiradi, u GitHub'dan buyruq va nazorat (C2), ma'lumotlar eksfiltratsiyasi va masofaviy boshqaruv uchun foydalanadi. Elastic tahdid klasterini REF8685 monikeri ostida kuzatmoqda.
Keyin o'tgan oyning boshida Palo Alto Networks Blinder Tunnel deb nomlanuvchi kampaniyaga e'tibor qaratdi — bu tahdid aktori (uni CL-STA-1178 deb ataydi) Dubay aeroportlari IT bo'limi sifatida niqoblanib, yuqori qiymatli nishonlarga zararli kodlash sinovlarini tarqatgan.
Soxta ishga yollash sxemasi birinchi marta 2026-yil mart oyining oxirida aniqlangan, garchi dalillar hujumchilar 2025-yil noyabridayoq hujum infratuzilmasini tayyorlash va sinovdan o'tkazayotganini ko'rsatadi.
Ijtimoiy muhandislik kampaniyasi aniq nishonlarga jozibador ish takliflari bilan murojaat qilib, ularni karera portalini taqlid qiluvchi va so'rovnomani to'ldirishni ko'rsatadigan mustaqil ilovani ishga tushirishga aldashga qaratilgan deb baholanadi.
So'rovnomani yuborish hech qanday ma'lumot eksfiltratsiyasiga yoki tashqi domen bilan javob boshlanishiga olib kelmaydi. Aksincha, u zararsiz chalg'ituvchi sifatida xizmat qiladi va ishonchni mustahkamlaydi, keyin esa Microsoft Visual Studio loyihasi arxivi ko'rinishidagi zararli dasturiy ta'minotni o'z ichiga olgan keyingi bosqich yukini yetkazadi — bu kodlash baholashi sifatida bezatilgan.
Hujum zanjiri doimiy kirishni o'rnatish uchun uchta texnikadan foydalanadi: zararli C# loyihasi ".csproj" fayli AppDomainManager injectionni ishga tushirish uchun ishlatiladi, so'ngra DLL sideloading SHELBYLOADER (aka ShelbyLoader V2) yangilangan versiyasini yetkazadi, u esa SHELBYC2 ni ishga tushiradi. Shuningdek, SHELBYC2 orqali Blackwood deb nomlanuvchi tunnellash yordamchi dasturi ham joylashtiriladi.
"Faoliyat ortidagi hujumchilar Dubay aeroportlari yollovchilari sifatida niqoblanib, Iroqda joylashgan yuqori qiymatli ish izlovchini nishonga olish uchun trojanlashtirilgan Visual Studio kodlash sinovidan foydalangan holda moslashtirilgan ijtimoiy muhandislik texnikalaridan foydalangan," deb aytdi Unit 42.
"Kampaniya o'rnatilgan ishlab chiquvchi vositalaridan noto'g'ri foydalanish va DLL sideloading bilan tavsiflanadi. Hujumchilar shuningdek, ETW [Windows uchun Hodisa Kuzatuvi] kabi xavfsizlik monitorlarini chetlab o'tish uchun AppDomainManager hijackingdan foydalangan."
Dream'dan olingan so'nggi topilmalar tahdid aktori ijtimoiy muhandislikka tayanishda davom etayotganini, shu bilan birga ham hisob ma'lumotlarini o'g'irlash, ham zararli dasturiy ta'minotni yetkazishni birlashtirayotganini ko'rsatadi. Bu hukumat, veb-pochta va bulut xizmati ko'rinishidagi domenlardan foydalanishni o'z ichiga oladi — hisob ma'lumotlarini yig'ish yoki hujumchi nazoratidagi fayl yuklab olishlarini taqdim etish uchun. Ta'kidlangan domenlar orasida quyidagilar bor:
- gcc-sg[.]cloud/owa/auth/logon.aspx
- mfakuwait[.]online/owa/auth/logon.aspx
- moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O
Tahdid aktori shuningdek, StarkMeet (stark-meet[.]com, stark-meet[.]online va stark-meet[.]website) deb nomlanuvchi soxta videokonferensiya ilovasi uchun chalg'ituvchi brend domenlarini o'rnatgan. Ilovani o'rnatish va ishga tushirish ShelbyLoader V2 va SHELBYC2 ishga tushirilishiga olib keladi.
Bu rivojlanish tahdid aktori zararli dasturiy ta'minotni yetkazishning turli usullarini — kodlash baholashlaridan soxta dasturiy ta'minotgacha — sinab ko'rayotganining belgisi hamdir.
Dream DarkBlinders faoliyati UNC5795 va Dust Specter bilan bir xil operatsion klasterga tegishli ekanligini aytdi — infratuzilma va zararli dasturiy ta'minot o'xshashliklarini keltirib. Zscaler tomonidan 2026-yil mart oyida hujjatlashtirilgan Dust Specter, Iroq Tashqi ishlar vazirligi sifatida niqoblanib, Iroqdagi hukumat amaldorlarini nishonga olgan Eron bilan bog'liq shubhali operatsiyaga ishora qiladi.
"Tarixiy server barmoq izlari, bir-biriga mos keluvchi nishonologiya va qo'llab-quvvatlovchi atributsiya tadqiqotlari bizni UNC5795 va UNC5187 kengroq APT34 guruhidagi bog'liq kichik klasterlar bo'lishi mumkinligi haqida o'rta ishonch bilan baholashga olib keladi," deb qo'shimcha qildi u.
"Ularning Iroq hukumat tashkilotlariga qaratilgan bir-biriga mos keluvchi e'tibori bu texnik aloqaga kontekst beradi va umumiy razvedka yig'ish manfaatini ko'rsatadi. Ularning mos ravishda APT34 bilan bog'liqliklari bilan birgalikda, bu topilmalar ikki klaster operatsion jihatdan bog'liq va bir xil kengroq guruhga tegishli bo'lishi mumkinligi haqida o'rta ishonchli baholashni qo'llab-quvvatlaydi."
Forsiya Shahzodasi C2 ni AQShda o'n yillikda birinchi marta joylashtirgan
Bu e'lon Eron hukumati tomonidan homiylik qilingan kam ma'lum tahdid guruhi — Forsiya Shahzodasi (aka Infy) — bu yil o'zining C2 serverlaridan birini ("68.65.122[.]203") AQShda ishlatayotgani kuzatilgan paytda e'lon qilindi. Server ehtimol 2026-yil iyul oyida qurilgan.
Infratuzilma Tornado — Tonnerre variantining ikkinchi bosqich C2 serveri bo'lib, u bir kunlik dasturiy ta'minot zaifliklari orqali tushiriladi va C2 uchun ham HTTPS, ham Telegram API'dan foydalanadi. 2026-yil may oyining oxirida yangi C2 serverlarining paydo bo'lishi uch oylik faoliyatsizlikdan keyin sodir bo'ldi — bu tahdid aktori faoliyatidagi "deyarli yigirma yillik faoliyatdagi eng uzoq to'xtash" deb ta'riflangan.
"Biz Forsiya Shahzodasining eksfiltratsiya faoliyatini so'nggi olti oy davomida kuzatib kelmoqdamiz," dedi Semperis xavfsizlik tadqiqotlari bo'yicha vitse-prezident o'rinbosari Tomer Bar. "Qurbonlar soni pastligicha qolmoqda, bu esa yoki maqsadli hujumlarni, yoki yangi qurbonlarni yuqtirishdagi qiyinchiliklarni ko'rsatishi mumkin."
"Eron tahdid aktori o'zining yangi C2 serverini AQSh hududida joylashtirishga qaror qildi — aynan AQSh va Eron o'rtasidagi so'nggi dushmanliklar boshlanishi bilan bir vaqtda. Bu tahdid aktorini yashirinishini kutgan oxirgi joy edi."
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.
According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud environment in the Kurdistan Region.
The activity has been attributed to a threat actor known as DarkBlinders, an Iran-nexus group assessed to be active since at least September 2024 and linked to attacks aimed at aviation infrastructure and telecommunications in the U.A.E. and Iraq. It exhibits no technical overlap with other known hacking groups.
Attacks mounted by the group are known to rely on spear-phishing as an initial access pathway to lure recipients into opening trojanized utilities or clicking on attacker-controlled websites that host similar tools as direct downloads.
Previous attack chains documented by Elastic Security Labs and Group-IB have led to the deployment of SHELBYLOADER (aka HOTAIR), which is launched via DLL sideloading to ultimately execute a backdoor called SHELBYC2 (aka AEROSTAT) that uses GitHub for command-and-control (C2), data exfiltration, and remote control. Elastic is tracking the threat cluster under the moniker REF8685.
Then early last month, Palo Alto Networks shed light on a campaign dubbed Blinder Tunnel in which the threat actor, which it calls CL-STA-1178, was observed masquerading as the Dubai Airports IT department to distribute malware-laced coding challenges to high-value targets.
The bogus recruitment scheme was first detected in late March 2026, although evidence indicates that the attackers were staging and testing attack infrastructure as far back as November 2025.
The social engineering campaign is assessed to have approached specific targets with lucrative job offers to trick them into executing a self-contained application that mimicked a career portal and instructed them to complete a questionnaire.
Submitting the questionnaire does not cause any data to be exfiltrated or initiate any response from an external domain. Instead, it's meant to serve as a harmless decoy and build credibility before delivering the next stage payload containing the malware in the form of a Microsoft Visual Studio project archive that's dressed up as a coding assessment.
The attack chain makes use of three techniques to establish persistent access: A malicious C# project ".csproj" file is used to trigger AppDomainManager injection, followed by DLL sideloading to deliver an updated version of SHELBYLOADER (aka ShelbyLoader V2), which then launches SHELBYC2. Also deployed via SHELBYC2 is a tunneling utility called Blackwood.
"The attackers behind the activity used tailored social engineering techniques to masquerade as Dubai Airports recruiters, using a trojanized Visual Studio coding challenge to target a high-value job seeker based in Iraq," Unit 42 said.
"The campaign is characterized by misuse of built-in developer tools and DLL sideloading. Attackers also used AppDomainManager hijacking to bypass security monitors like ETW [Event Tracing for Windows]."
The latest findings from Dream show that the threat actor continues to rely on social engineering, while combining both credential phishing and malware delivery. This involves the use of government, webmail, and cloud-service lookalike domains to collect credentials or present attacker-controlled file downloads. Some of the highlighted domains include -
- gcc-sg[.]cloud/owa/auth/logon.aspx
- mfakuwait[.]online/owa/auth/logon.aspx
- moelcloud[.]online/drive/file/d/1JpH3ySmJpvX6TyGnF7C-S8qYiaoxyC5O
The threat actor has also been observed setting decoy brand domains for a fake videoconferencing application called StarkMeet (stark-meet[.]com, stark-meet[.]online, and stark-meet[.]website). Installing and launching the app leads to the execution of ShelbyLoader V2 and SHELBYC2.
The development is also a sign that the threat actor is trying out different methods for malware delivery, ranging from coding assessments to counterfeit software.
Dream said the DarkBlinders activity belongs to the same operational cluster as UNC5795 and Dust Specter, citing infrastructure and malware overlaps. Dust Specter, documented by Zscaler in March 2026, refers to a suspected Iran-nexus operation targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs.
"Historical server fingerprints, overlapping victimology, and supporting attribution research lead us to assess with medium confidence that UNC5795 and UNC5187 may represent related sub-clusters within the broader APT34 group," it added.
"Their overlapping focus on Iraqi government entities adds context to this technical connection and suggests a shared intelligence collection interest. Combined with their respective APT34 associations, these findings support a medium-confidence assessment that the two clusters are operationally related and may belong to the same broader group."
Prince of Persia Hosts C2 in the U.S. for the First Time in a Decade
The disclosure comes as Prince of Persia (aka Infy), a lesser-known threat group sponsored by the Iranian government, has been observed running one of its C2 servers ("68.65.122[.]203") from the U.S. this year. The server was likely built in July 2026.
The infrastructure is a second-stage C2 server associated with Tornado, a Tonnerre variant that's dropped via one-day software vulnerabilities and uses both HTTPS and the Telegram API for C2. The emergence of new C2 servers in late May 2026 follows three months of inactivity, which has been described as the "longest downtime in nearly two decades of activity by the threat actor."
"We have been monitoring Prince of Persia's exfiltration activity for the past six months," Tomer Bar, associate vice president of security research at Semperis, said. "The number of victims remains low, which could indicate either targeted attacks or difficulties infecting new victims."
"The Iranian threat actor decided to host its new C2 server on U.S. soil — at the same time as the beginning of the recent hostilities between Iran and the United States. This is the last place we expected to find the threat actor hiding."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.