DarkBlinders is a sophisticated cyberespionage campaign active from August to October 2026 targeting Israel and the Kurdistan Region of Iraq. The attackers compromised a high-profile Israeli security sector individual and a government cloud environment in Kurdistan. They used phishing lures impersonating Gulf Cooperation Council and Kuwait government entities and leveraged GitHub repositories for command-and-control. Post-compromise activities included credential theft and exfiltration of at least 1 GB of data from the government cloud.
