DarkBlinders Espionage Hits Kurdistan Government Cloud and an Israeli Security Figure — Fake StarkMeet App Plants a Backdoor Commanded Through GitHub

High · 2026-11-08 · By H.A

Researchers detail DarkBlinders, an August–October 2026 campaign linked to UNC5795 that used fake Kuwaiti and GCC logins and a decoy StarkMeet app to plant an operator-gated backdoor polling GitHub every 63 seconds.

Overview

Security researchers have published details of DarkBlinders, an espionage campaign that ran from August to October 2026 and was still active when reported. It targeted Israel and the Kurdistan Region of Iraq, with phishing infrastructure imitating Gulf diplomatic bodies.

Two compromises are confirmed:

• a government cloud environment in Iraqi Kurdistan, where credentials were stolen and at least 1 GB of data was taken;
• a high-profile individual in Israel with ties to the security sector.

The researchers link the activity, with medium-to-high confidence, to the clusters tracked as UNC5795 and Dust Specter. They also see a medium-confidence connection to APT34 subclusters. They describe the Iranian nexus as contextual, not conclusive. The malware is related to the family behind the earlier Blinder Tunnel activity.

The Campaign

Lures

• Fake Outlook Web App login pages imitating the Kuwait Ministry of Foreign Affairs and the GCC Secretariat General.
• Google Drive-style download pages on lookalike domains, including Kurdistan Regional Government themes. One page served Attachment.zip behind a fake "preview failed" message.
• StarkMeet, a fake video-meeting app (version 3.2) whose Join button always fails. It is a decoy while the implant installs.

Infection chain

1. The victim runs the StarkMeet installer from a ZIP archive.
2. Malicious components are dropped in %LOCALAPPDATA%\Microsoft\RuntimeBroker. A legitimate signed .NET host, renamed RuntimeBroker.exe, loads RuntimeBroker.dll.
3. Persistence is an HKCU Run value named MicrosoftRuntime. The first check-in happens 121 seconds after start-up, then every hour.
4. The loader writes a host profile and anti-analysis results to a GitHub repository (myLic).
5. The operator reviews each new host and activates only chosen victims by supplying key material. About ten hosts registered, but only two were activated.
6. The backdoor (RuntimeBrokerApi.dll, AES-256-CBC encrypted) runs in memory and polls a second repository (myCode) about every 63 seconds for tasks.

Timeline

• 2025: earlier waves use the GitHub accounts johnshelllby, arturshellby and GreenBeret0, then peakyblinders-team and peakyblinders-tm.
• July–October 2026: lure and decoy infrastructure is active, hosted in the UK and the Netherlands.
• August–October 2026: active intrusions and data theft.
• October–November 2026: the research and indicators are published.

Tradecraft

• GitHub as C2. Registration and tasking run through the GitHub Contents API, so the traffic blends in with normal developer activity.
• Operator-gated second stage. Researchers' sandboxes and uninteresting hosts never receive the decryption key. This keeps the backdoor out of most automated analysis.
• C2 rotation without touching victims. A "magic comment" mechanism searches public issue comments in the Microsoft/vscode repository for encrypted credential updates. A Cloudflare Worker serves as a fallback relay.
• PowerShell without powershell.exe. Commands run inside the process through a System.Management.Automation runspace (PsProxy.dll).
• Both .NET binaries are obfuscated with Obfuscar and carry Microsoft-themed version metadata. A remote file-management console called TommyFiles handles data theft.

Indicators of Compromise

Domains:  gcc-sg[.]cloud  mfakuwait[.]org  mfakuwait[.]online  krgcloud[.]online
          moelcloud[.]online  korektell[.]com  stark-meet[.]com  starkmeet[.]com
          meetcloud[.]site  drive-g[.]cloud
IPs:      194.62.249[.]114  194.62.249[.]19  194.62.249[.]53  89.125.209[.]80
          78.17.71[.]148  77.223.215[.]140
GitHub:   account PeakyBlindersTeam, repositories myLic and myCode
Worker:   g-prx.itugegape524.workers[.]dev
Host:     %LOCALAPPDATA%\Microsoft\RuntimeBroker\RuntimeBroker.exe / RuntimeBroker.dll / RuntimeBrokerApi.dll
          HKCU\Software\Microsoft\Windows\CurrentVersion\Run  value "MicrosoftRuntime"

The researchers list more than 60 SHA-256 hashes. Use the full published set for retro-hunting.

Detection

• Alert on RuntimeBroker.exe running from anywhere other than C:\Windows\System32. The real Windows binary never runs from %LOCALAPPDATA%.
• Hunt for the MicrosoftRuntime Run value and StarkMeet files under user profiles.
• Flag non-browser processes calling the GitHub Contents API or /search/issues against Microsoft/vscode. Match the exact repository paths and Worker hostname above instead of blocking GitHub or Cloudflare entirely.
• Watch for .NET processes loading System.Management.Automation.dll without starting powershell.exe.

Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' | Select-Object MicrosoftRuntime
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\RuntimeBroker" -ErrorAction SilentlyContinue

Recommended Actions

1. Block the listed domains and IPs. Search DNS, proxy and email logs back to July 2026 for any hits.
2. Teach diplomatic, government and defence staff that webmail logins on non-official domains and unknown "meeting apps" sent by contacts are warning signs.
3. Enforce phishing-resistant MFA on webmail and government cloud tenants, and review sign-ins from unfamiliar hosting providers.
4. Use application control to stop unsigned or newly downloaded installers from running out of user-writable paths.
5. Organisations in the Gulf, Iraq and Israel should treat any confirmed hit as an espionage incident and preserve memory before cleaning up, because the backdoor runs mainly in memory.

Analyst Assessment

DarkBlinders is a small, selective operation, not a mass campaign. The operator vets every victim by hand, and only a few receive the real backdoor. That discipline, plus C2 hidden in GitHub traffic, makes it hard to detect at the network level. The lures pointing at Kuwait and the GCC suggest the targeting goes beyond the two confirmed victims to Gulf diplomatic networks. Host artefacts such as a misplaced RuntimeBroker and the Run key are the most dependable way for defenders to find it.