State-backedIran
DarkBlinders
2mentions, 7 days
2mentions, 30 days
Nov 3, 2026last mentioned
DarkBlinders hackers are deploying a fake video meeting application to establish a backdoor and facilitate cyberespionage against Israel and the Kurdistan Region of Iraq. Their operations have led to compromises within a government cloud environment in Kurdistan and targeting a significant Israeli individual linked to security. They are also abusing GitHub repositories as part of their TTPs. The investigation has confirmed their focused efforts in this cyber campaign.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- 🚨 🇮🇷 Iran-linked DarkBlinders hackers breached a government cloud environment in Iraqi Kurdistan and stole at least 1 GB of data. The cyberespionage campaignmastodon · Nov 3, 2026
- DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment An Iran state-aligned threat actor carried out a cyber espionage campaignmastodon · Nov 3, 2026
References
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.