Severity: High | Priority: 1
This update adds signatures covering the infrastructure of DarkBlinders, an espionage group that was active against targets in the Middle East between August and October 2026. Researchers assess with medium to high confidence that the group belongs to the same cluster as UNC5795 and Dust Specter, which they place within the wider APT34 group. DarkBlinders builds convincing lookalike sites for regional government and business organisations. These include webmail login pages imitating the Gulf Cooperation Council Secretariat General and the Kuwait Ministry of Foreign Affairs, and file-sharing pages themed around the Kurdistan Regional Government and its Ministry of Electricity. Other sites impersonate Korek Telecom, Microsoft OneDrive, and misspelled versions of Google Drive, Google Meet and Google account security.
The campaign uses two methods. In the first, victims are led to fake Outlook Web Access login pages that capture their usernames and passwords. In the second, victims are persuaded to download a file presented as a document attachment, or to install a fake video-meeting application called StarkMeet. StarkMeet shows a working decoy app while silently installing a backdoor in the user’s local Microsoft folder. The backdoor runs through a renamed, legitimately signed program and sets itself to start with Windows. It then waits for the attacker to activate it individually for each chosen victim. Once active, it takes commands through private GitHub repositories. This lets the attacker run PowerShell commands, upload and download files, and steal data, while the traffic blends in with normal developer activity. The attacker can also switch to new GitHub accounts by posting hidden instructions in comments on a popular public software project, and can reroute traffic through a Cloudflare Worker relay.