Israel’s security establishment is facing a relentless Iranian cyber threat: security researchers are revealing details of a targeted espionage operation carried out by a cyber cell operating under the auspices of the Tehran regime, which led to the compromise of a high-profile individual directly connected to Israel’s security sector. According to a comprehensive report published by Dream Research Labs, the attack is attributed to a hacking group known as DarkBlinders. The cell carried out a series of covert intrusions against targets in Israel while simultaneously breaching the cloud infrastructure of the regional government in Iraqi Kurdistan.
1+The group’s operating method relied on sophisticated, highly targeted social engineering. The attackers set up a series of fake phishing sites that mimicked login pages for webmail services and government cloud servers, aiming to steal usernames and access passwords. At the same time, the cell created counterfeit brand websites offering a fabricated video call software called StarkMeet for download. Once the target installed the application, malicious code planted on their device activated an advanced backdoor called ShelbyLoader.
To hide their activity from defense and monitoring systems, the attackers used a sophisticated command-routing technique: the backdoor communicated and received control instructions directly through the GitHub code development platform. This approach makes espionage traffic appear legitimate and routine on the corporate network, making it difficult for security teams to block the malware’s communications. In a parallel campaign exposed by Palo Alto, the same cell impersonated the recruitment department of Dubai Airport and sent infected programming assignments to engineers.
1+The Iranian espionage arm operated simultaneously in the regional arena. Alongside the penetration of the Israeli target, the attackers managed to breach a government cloud environment of the Kurdish region in Iraq and extract at least one gigabyte of classified documents and information from it. Cyber researchers link the cell to the central attack infrastructure of Iranian intelligence known as APT34, which has operated for many years, collecting intelligence on government entities, aviation, and communications in the Middle East and the United Arab Emirates.
The disclosure comes alongside unusual findings by Israeli cybersecurity firm Semperis, which recently identified command and control servers of another Iranian espionage group operating from within United States territory at the height of security tensions. For those working in Israel’s security establishment and technology companies, the incident illustrates the precision of the Revolutionary Guards’ cyber units. Security experts repeatedly warn that utmost vigilance is needed against unidentified online contacts; avoid downloading call software from unfamiliar sites, and use hardware-based multi-factor authentication on every organizational and personal system.