Researchers uncovered a DarkBlinders espionage campaign targeting Israel and Kurdistan between August and October 2026.
The activity compromised a high-profile target and a government cloud environment using spear-phishing, trojanized utilities, AppDomainManager injection, and DLL sideloading.
The group, known as DarkBlinders, uses a variety of methods to trick its victims. In some cases, the perpetrators impersonate recruiters from large companies, such as Dubai Airports, and send fake programming tests or job offers. When targets open these files on their computers, dangerous programs are secretly installed on the system.
Fake websites and apps
In addition to fake business messages, attackers have set up fake websites that resemble online services, corporate emails, or even a fake video conferencing app called StarkMeet. Through these sites, they try to steal passwords or trick users into downloading malicious software.
Researchers say the group appears to be linked to similar past attacks on aviation and telecommunications infrastructure in the United Arab Emirates and Iraq. Experts estimate with moderate certainty that the same perpetrators may be linked to other known cyberespionage groups in the region.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)