Espionage group reaches a Kurdistan Region government cloud, researchers say

Dream Research Labs reports that a campaign it tracks as DarkBlinders compromised a government cloud environment in Iraq's Kurdistan Region, as well as a prominent person in Israel, in activity dated to August and October 2026. Lures imitated Kuwait's foreign ministry, the GCC secretariat and Kurdistan-themed cloud domains, and the malware used GitHub for control.

Confirmed

The compromise is reported by the researchers. Attribution to an Iran-linked actor is their assessment; other firms rate it with lower confidence.

What to do

Government IT teams in Iraq and the Gulf: hunt for connections to GitHub-hosted control pages from servers that should not reach GitHub.
Warn staff about login pages imitating ministries and the GCC secretariat.

Sources

thehackernews · DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment · 2026-11-02
cybelangel · CybelAngel summary of Dream Research Labs' DarkBlinders report · date unknown
gbhackers news · DarkBlinders APT Hackers Target Israel and Iraqi Kurdistan With StarkMeet Malware and GitHub-Based Backdoors · 2026-11-03

How we verify stories · A correction? corrections@aswarcyber.com