DarkBlinders Espionage Hits Kurdistan Government Cloud and an Israeli Security Figure — Fake StarkMeet App Plants a Backdoor Commanded Through GitHub

High · 2026-11-08 · By H.A

DarkBlinders Espionage Hits Kurdistan Government Cloud and an Israeli Security Figure — Fake StarkMeet App Plants a Backdoor Commanded Through GitHub

Researchers detail DarkBlinders, an August–October 2026 campaign linked to UNC5795 that used fake Kuwaiti and GCC logins and a decoy StarkMeet app to plant an operator-gated backdoor polling GitHub every 63 seconds.

Overview

Security researchers have published details of DarkBlinders, an espionage campaign that ran from August to October 2026 and was still active when reported. It targeted Israel and the Kurdistan Region of Iraq, with phishing infrastructure imitating Gulf diplomatic bodies.

Two compromises are confirmed:

The researchers link the activity, with medium-to-high confidence, to the clusters tracked as UNC5795 and Dust Specter. They also see a medium-confidence connection to APT34 subclusters. They describe the Iranian nexus as contextual, not conclusive. The malware is related to the family behind the earlier Blinder Tunnel activity.

The Campaign

Lures

Infection chain

  1. The victim runs the StarkMeet installer from a ZIP archive.
  2. Malicious components are dropped in %LOCALAPPDATA%\Microsoft\RuntimeBroker. A legitimate signed .NET host, renamed RuntimeBroker.exe, loads RuntimeBroker.dll.
  3. Persistence is an HKCU Run value named MicrosoftRuntime. The first check-in happens 121 seconds after start-up, then every hour.
  4. The loader writes a host profile and anti-analysis results to a GitHub repository (myLic).
  5. The operator reviews each new host and activates only chosen victims by supplying key material. About ten hosts registered, but only two were activated.
  6. The backdoor (RuntimeBrokerApi.dll, AES-256-CBC encrypted) runs in memory and polls a second repository (myCode) about every 63 seconds for tasks.

Timeline

Tradecraft

Indicators of Compromise

Domains:  gcc-sg[.]cloud  mfakuwait[.]org  mfakuwait[.]online  krgcloud[.]online
          moelcloud[.]online  korektell[.]com  stark-meet[.]com  starkmeet[.]com
          meetcloud[.]site  drive-g[.]cloud
IPs:      194.62.249[.]114  194.62.249[.]19  194.62.249[.]53  89.125.209[.]80
          78.17.71[.]148  77.223.215[.]140
GitHub:   account PeakyBlindersTeam, repositories myLic and myCode
Worker:   g-prx.itugegape524.workers[.]dev
Host:     %LOCALAPPDATA%\Microsoft\RuntimeBroker\RuntimeBroker.exe / RuntimeBroker.dll / RuntimeBrokerApi.dll
          HKCU\Software\Microsoft\Windows\CurrentVersion\Run  value "MicrosoftRuntime"

The researchers list more than 60 SHA-256 hashes. Use the full published set for retro-hunting.

Detection

Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' | Select-Object MicrosoftRuntime
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\RuntimeBroker" -ErrorAction SilentlyContinue

Recommended Actions

  1. Block the listed domains and IPs. Search DNS, proxy and email logs back to July 2026 for any hits.
  2. Teach diplomatic, government and defence staff that webmail logins on non-official domains and unknown "meeting apps" sent by contacts are warning signs.
  3. Enforce phishing-resistant MFA on webmail and government cloud tenants, and review sign-ins from unfamiliar hosting providers.
  4. Use application control to stop unsigned or newly downloaded installers from running out of user-writable paths.
  5. Organisations in the Gulf, Iraq and Israel should treat any confirmed hit as an espionage incident and preserve memory before cleaning up, because the backdoor runs mainly in memory.

Analyst Assessment

DarkBlinders is a small, selective operation, not a mass campaign. The operator vets every victim by hand, and only a few receive the real backdoor. That discipline, plus C2 hidden in GitHub traffic, makes it hard to detect at the network level. The lures pointing at Kuwait and the GCC suggest the targeting goes beyond the two confirmed victims to Gulf diplomatic networks. Host artefacts such as a misplaced RuntimeBroker and the Run key are the most dependable way for defenders to find it.

REEF SENTINEL