# Researchers link DarkBlinders to Iraqi Kurdish government cloud compromise

_Published Monday, November 2, 2026 at 11:02 AM EST · Security · Latest · Tier 2 — Notable_

![Researchers link DarkBlinders to Iraqi Kurdish government cloud compromise — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7nIwDn7LIoF8OUZdj0NRjq4ZMu-xjzcOPQJDwouwkwqwVe618e77am9iyAIez63Q8jVqZi7OtU43gJlhbZT-_4l_4pUq3tYpDUe4ErouPlkNi8YTNZiPQ6KmX2Ci028oT24DRcPtCdKv_zZ33_ZHOodARrbmcwxYWCAx4r45Qc0qVOQNmCCoWZmAWJnzt/s1700-nu-rw-lo-l85-e365/shelby-hacker.png)

Dream Research Labs disclosed compromises affecting a government cloud environment in the Kurdistan Region of Iraq and a high-profile individual in Israel, attributing the August-October 2026 campaign to the Iran-aligned group DarkBlinders.

The researchers found that attackers combined credential phishing with malware downloads, using lookalike government, webmail and cloud-service domains. A fake videoconferencing application called StarkMeet installs ShelbyLoader V2 and SHELBYC2 when launched.

Dream linked the activity to other operational clusters through infrastructure and malware overlaps, while describing its assessment of broader group relationships as medium confidence.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html)

---
Canonical: https://techandbusiness.org/newswire/m3uB5-nKH6Udcg21jydQik
Published: 2026-11-02T16:02:15.997Z
Story chronology: 2026-11-02T14:46:00.000Z
Retrieved: 2026-11-02T18:35:38.999Z
Publisher: Tech & Business (techandbusiness.org)