DarkBlinders: Active Espionage Campaign

DarkBlinders is a sophisticated cyberespionage campaign active from August to October 2026 targeting Israel and the Kurdistan Region of Iraq. The attackers compromised a high-profile Israeli security sector individual and a government cloud environment in Kurdistan. They used phishing lures impersonating Gulf Cooperation Council and Kuwait government entities and leveraged GitHub repositories for command-and-control. Post-compromise activities included credential theft and exfiltration of at least 1 GB of data from the government cloud.

• VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage CampaignMalware2026-10-31
• Dissection of Operation FlashHole, a complex attack by LazarusMalware2026-10-21
• Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical InfrastructureMalware2026-10-07
• Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesCampaign2026-10-01
• Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMalware2026-09-30