Iran‑linked DarkBlinders hacks Israeli target and Kurdish government cloud using fake apps
The DarkBlinders group, described as Iran‑linked, has compromised a high‑profile Israeli individual and a government cloud environment in Iraqi Kurdistan through fake apps, credential theft and a GitHub‑based backdoor.
A cyber‑espionage operation attributed to an Iran‑linked group is reaching into both personal and government systems in the region.
Researchers say a group known as DarkBlinders has compromised a high‑profile Israeli individual and a government cloud environment in Iraqi Kurdistan. The campaign relies on fake applications, credential‑phishing techniques and custom malware.
One of DarkBlinders’ tools is a backdoor that uses GitHub for command‑and‑control, blending its traffic with connections many organizations treat as routine. That makes the operation harder to spot on busy networks.
Targeting a prominent Israeli victim suggests an interest in highly sensitive personal or professional information. Access to a Kurdish government cloud environment offers a window into administrative data and internal systems in Iraqi Kurdistan.
For those affected, such compromises can expose communications, stored files and authentication details that unlock yet more accounts. Because the attackers work through ordinary‑looking apps and login prompts, victims may not realize anything is wrong until long after the first breach.
Further reporting on what data was accessed, how the victims respond, and whether similar techniques appear against other targets will show whether this is a limited operation or part of a broader regional push.
Sources
- OSINT