Threat reportAPTTL-2026-5063
DarkBlinders (CL-STA-1178 / REF8685, Iran state-aligned) Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment via ShelbyLoader V2, Blackwood and GitHub C2
DarkBlinders, an Iran state-aligned actor active since at least September 2024, compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq between August and October 2026. The campaign uses SHELBYLOADER/SHELBYC2 (including ShelbyLoader V2), the Blackwood Chisel-based tunneling utility and a Tornado/Tonnerre variant, delivered via spear-phishing, trojanized utilities and fake coding assessments, with GitHub abused for C2 and exfiltration. First disclosed .
Key facts
| Identifiers | TL-2026-5063 |
|---|---|
| Also known as | Blinder Tunnel, ShelbyLoader V2, HOTAIR, AEROSTAT, Prince of Persia |
| Severity | HIGH |
| First disclosed | |
| Affected products | Microsoft Windows (developer workstations running Visual Studio / .NET Framework); GitHub GitHub API / Issues (abused as C2 and exfiltration channel); Microsoft Cloud environment of Kurdistan Region of Iraq government (compromised tenant) |
| Attribution | DarkBlinders (medium confidence) |
| Nation-state nexus | Iran |
| Malware | SHELBYLOADER, Tonnerre |
| Tools | Blackwood, Chisel |
| MITRE ATT&CK techniques | T1008 Fallback Channels, T1036.005 Masquerading: Match Legitimate Resource Name or Location, T1059.001 Command and Scripting Interpreter: PowerShell, T1127 Trusted Developer Utilities Proxy Execution, T1132.001 Data Encoding: Standard Encoding, T1204.002 User Execution: Malicious File, T1497 Virtualization/Sandbox Evasion, T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, T1566 Phishing, T1566.002 Phishing: Spearphishing Link, T1572 Protocol Tunneling, T1574.001 DLL and 3 more in the attack flow |
| Motivation | ESPIONAGE |
| Target sectors | government administration, aviation, telecoms, critical infrastructure, individuals |
| Target regions | Middle East, iraq, israel, united arab emirates |
| Detection rules | 9 (1 shown free) |
| Sources | 5 cited sources |
Detection coverage
As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5063 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: DarkBlinders ShelbyLoader V2 Sideload Staging in RuntimeBrokers Directory (Exploitation)
Detects Sysmon file-creation events that stage the ShelbyLoader V2 (HOTAIR) / ShelbyC2 (AEROSTAT) sideload set in the user-writable %LOCALAPPDATA%\Microsoft\RuntimeBrokers directory: a renamed RuntimeBroker.exe host, a modified RuntimeBroker.exe.config (AppDomainManager injection with etwEnable=false), RuntimeBroker.dll, RuntimeBrokerApi.dll and PsProxy.dll. The legitimate RuntimeBroker.exe lives only in System32, so any write to a 'RuntimeBrokers' folder is high fidelity. Part of the DarkBlinders (CL-STA-1178 / REF8685) Blinder Tunnel campaign, TL-2026-5063.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1574.014, T1574.001, T1562.006, T1036.005
- Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceFileEvents
- Severity: critical
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*RuntimeBrokers*" (TargetFilename="*RuntimeBroker.exe.config" OR TargetFilename="*RuntimeBroker.exe" OR TargetFilename="*RuntimeBroker.dll" OR TargetFilename="*RuntimeBrokerApi.dll" OR TargetFilename="*PsProxy.dll") | eval writer=lower(Image) | stats min(_time) as first_seen max(_time) as last_seen dc(TargetFilename) as distinct_files values(TargetFilename) as dropped_files values(writer) as writer_processes by host User | where distinct_files>=2 OR match(mvjoin(dropped_files,"|"),"(?i)exe[.]config") | convert ctime(first_seen) ctime(last_seen)Microsoft KQL
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "RuntimeBrokers"
| where FileName in~ ("RuntimeBroker.exe.config", "RuntimeBroker.exe", "RuntimeBroker.dll", "RuntimeBrokerApi.dll", "PsProxy.dll")
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), FileCount = dcount(FileName), DroppedFiles = make_set(FileName), Writers = make_set(InitiatingProcessFileName) by DeviceName, InitiatingProcessAccountName
| where FileCount >= 2 or tostring(DroppedFiles) has "RuntimeBroker.exe.config"Sigma
title: DarkBlinders ShelbyLoader V2 Sideload Staging in RuntimeBrokers Directory
id: 7d2a41c8-3b59-4e0f-a6c1-9f8e5b1d2c01
status: experimental
description: Detects creation of the ShelbyLoader V2 / ShelbyC2 sideload set (RuntimeBroker.exe, RuntimeBroker.exe.config, RuntimeBroker.dll, RuntimeBrokerApi.dll, PsProxy.dll) inside the user-writable Microsoft\RuntimeBrokers directory, as used by DarkBlinders (CL-STA-1178 / REF8685) in the Blinder Tunnel campaign.
references:
- https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
- https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html
author: Threadlinqs Team
date: 2026-11-02
tags:
- attack.persistence
- attack.t1574.014
- attack.t1574.001
- attack.defense-evasion
- attack.t1562.006
- attack.t1036.005
logsource:
category: file_event
product: windows
detection:
selection_dir:
TargetFilename|contains: '\Microsoft\RuntimeBrokers\'
selection_files:
TargetFilename|endswith:
- '\RuntimeBroker.exe.config'
- '\RuntimeBroker.exe'
- '\RuntimeBroker.dll'
- '\RuntimeBrokerApi.dll'
- '\PsProxy.dll'
condition: selection_dir and selection_files
falsepositives:
- Unlikely; the genuine RuntimeBroker.exe is only installed under C:\Windows\System32
level: highKnown false positives:
- Software that legitimately creates a folder named RuntimeBrokers in a user profile (rare, none known)
- Red-team or malware-analysis sandboxes replaying the Blinder Tunnel sample
Tuning notes: Change the index/sourcetype to match your Sysmon ingestion (requires Sysmon EventCode 11 FileCreate logging). Exclude analyst sandbox hosts by host name. The distinct_files threshold can be lowered to 1 for a stricter posture.
- Visual Studio / MSBuild Design-Time Build Launching RuntimeBroker from User Profile (Exploitation) · unlock with TL Creds
- DarkBlinders PsProxy In-Memory PowerShell Runspace and Sideloaded Implant DLLs (Post-Exploitation) · unlock with TL Creds
- DarkBlinders Blackwood Chisel Tunnel and Tornado/Tonnerre C2 Connections (C2 / Tunneling) · unlock with TL Creds
- DarkBlinders Phishing and StarkMeet Lure Domain Resolution (Exploitation / Initial Access) · unlock with TL Creds
- Masqueraded RuntimeBroker.exe Executing Outside System32 (Post-Exploitation) · unlock with TL Creds
- DarkBlinders GitHub Repo C2 and Issues Search Fallback Channel (C2) · unlock with TL Creds
- DarkBlinders ShelbyLoader V2 MicrosoftRuntime Run Key Persistence (Post-Exploitation) · unlock with TL Creds
- DarkBlinders GitHub Dead-Drop C2 DNS Activity from Non-Browser Process (C2) · unlock with TL Creds
Indicators of compromise
As of 2026-11-02, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-5063.
Sample indicators (3 of 31)
- IP address:
68.65.122[.]203 - Domain:
gcc-sg[.]cloud - File hash:
53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402
Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.
Technical analysis
DarkBlinders is an Iran-nexus cluster assessed to be active since at least September 2024 and previously linked to attacks on aviation infrastructure and telecommunications in the UAE and Iraq. Palo Alto Networks Unit 42 tracks the activity as CL-STA-1178 and Elastic Security Labs tracks the SHELBYLOADER cluster as REF8685. According to a Dream Research Labs report summarized by The Hacker News on 2026-11-02, the actor compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq between August and October 2026. Other vendors credited in the coverage are Group-IB, Semperis and Google Cloud Community. Overlaps are reported with UNC5795 (Google Cloud Community assessment), Dust Specter and, at medium confidence, APT34 sub-clusters.
Initial access relies on social engineering. Reported lures include spear-phishing with trojanized utilities, lookalike credential-phishing pages (Outlook Web Access-style logon pages and cloud-drive pages on gcc-sg.cloud, mfakuwait.online and moelcloud.online), a fake StarkMeet videoconferencing application hosted on stark-meet domains, and fake recruitment impersonating the Dubai Airports IT department. In the Unit 42 'Blinder Tunnel' analysis (published 2026-10-06), victims first receive an Inno Setup-packaged offline career portal with a decoy 10-question HR questionnaire that executes nothing malicious. They are then sent a weaponized Visual Studio coding challenge (DubaiAirport_Carrers_IT_Test.zip). It contains a personalized Readme.md, a C# Flight Management System with an intentional bug, and a malicious FlightManager.csproj that hijacks the GetFrameworkPaths target. The target runs during Visual Studio's background design-time build, so no user action beyond opening the project is needed.
The .csproj copies binaries from the project's Resources folder to %LOCALAPPDATA%\Microsoft\RuntimeBrokers and launches a renamed legitimate RuntimeBroker.exe. A modified RuntimeBroker.exe.config injects a malicious AppDomainManager before the host process initializes and sets etwEnable to false, which disables Event Tracing for Windows. A DLL search-order hijack then loads the malicious RuntimeBroker.dll, which is ShelbyLoader V2 (also tracked as HOTAIR). The loader fingerprints the host and checks for virtualization markers in WMI, processes, registry keys and files. It persists through the HKCU Run value MicrosoftRuntime, beacons every 63 seconds, and authenticates to GitHub with a hard-coded Personal Access Token. PsProxy.dll runs PowerShell in memory through a hidden runspace on System.Management.Automation.dll without spawning powershell.exe. ShelbyC2 V2 (RuntimeBrokerApi.dll, also tracked as AEROSTAT) is the RAT. It decrypts with AES-CBC using the SHA-256 of 'license' content fetched from GitHub, executes commands via PsProxy, and stages Blackwood.
GitHub is the C2 and exfiltration channel. The account peakyblinders-tm and repository myLic hold per-machine files: Base64-encoded fingerprints go to /{machineId}/Lic.txt and tasks are read from /{machineId}/Inf.txt, with a one-hour sleep on HTTP 403. If the token is revoked or returns HTTP 401, the implant falls back to the GitHub Issues Search API using date-based (yyyymmdd) queries. It reads AES-256-CBC ciphertext hidden in HTML comment markers; the key is derived from MD5(date + machineId), and the decrypted data carries updated Owner, LicRepo and LicToken values. Blackwood is a zero-disk tunneling utility wrapping the open-source Chisel tool. It is embedded as an 8.4 MB manifest resource (Blackwood.Cheese.xml) encrypted with AES-256-CBC, its config is RC4-encrypted, and it uses the same AppDomainManager and DLL-sideloading deployment pattern. Blackwood tunnel endpoints include 91.107.156.29, 87.248.129.239 and 65.109.214.145. A Blackwood payload archive (Client.zip) was hosted in the peakyblinders-tm/pubs repository, created 2026-05-01.
Semperis reporting cited by the source describes a Tornado/Tonnerre variant used as second-stage C2 on Prince of Persia infrastructure at 68.65.122.203 (US-hosted, July 2026) over HTTPS and the Telegram API, the first US-based C2 in roughly a decade of that operation. Attribution to Iran rests on Iranian ISP hosting for Blackwood endpoints, Persian-language domain resolution, MP3 metadata pointing to the Iranian site MusicDel.ir, regional victimology and tradecraft overlaps with Screening Serpens/UNC1549 (AppDomainManager hijacking with ETW disabling) and Agent Serpens/APT35 (GitHub dead-drop resolvers, in-memory .NET PowerShell wrappers). No CVE or CVSS is associated with this campaign; it abuses legitimate developer tooling and trusted platforms rather than a software vulnerability.
MITRE ATT&CK techniques by tactic:
Command and Control
T1008 Fallback Channels; T1132.001 Data Encoding: Standard Encoding; T1572 Protocol Tunneling
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1127 Trusted Developer Utilities Proxy Execution; T1497 Virtualization/Sandbox Evasion
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Initial Access
T1566 Phishing; T1566.002 Phishing: Spearphishing Link
stealth
T1574.001 DLL; T1574.014 Hijack Execution Flow: AppDomainManager
Resource Development
T1583.001 Acquire Infrastructure: Domains
defense-impairment
Remediation
Immediate actions
- Block and sinkhole the listed phishing and StarkMeet domains and the listed C2/tunneling IP addresses at DNS, proxy and perimeter
- Hunt for %LOCALAPPDATA%\Microsoft\RuntimeBrokers\ containing RuntimeBroker.exe, RuntimeBroker.dll, RuntimeBrokerApi.dll or PsProxy.dll, and for the HKCU Run value MicrosoftRuntime
- Alert on creation or modification of *.exe.config files that set etwEnable to false or define an appDomainManagerAssembly
- Alert on outbound connections to api.github.com from non-developer hosts and on access to peakyblinders-tm/myLic or peakyblinders-tm/pubs
- Review and rotate credentials and OAuth/session tokens for users who opened lookalike OWA/drive pages, and review cloud tenant sign-ins for the Kurdistan Region government environment
Workarounds
- Disable automatic design-time builds or open untrusted projects in a disposable VM
- Block Telegram API and unneeded GitHub API traffic from sensitive segments
Longer-term hardening
- Enforce ETW integrity monitoring and EDR behavioral detection for AppDomainManager hijacking and DLL sideloading
- Restrict GitHub API access to approved organizations and repositories and audit GitHub token usage
- Open untrusted Visual Studio projects only in isolated environments, and monitor for build-time process execution from MSBuild and devenv
- Harden government cloud environments with MFA and conditional access
- Train staff and job seekers on fake recruitment and coding-assessment lures
Affected and fixed versions
- Microsoft — Windows (developer workstations running Visual Studio / .NET Framework)
Vulnerable versions: Not version-specific; abuse of legitimate Visual Studio design-time build, AppDomainManager and DLL search-order behavior - GitHub — GitHub API / Issues (abused as C2 and exfiltration channel)
Vulnerable versions: Not applicable; platform misuse - Microsoft — Cloud environment of Kurdistan Region of Iraq government (compromised tenant)
Vulnerable versions: Not specified in sources
Timeline
- DarkBlinders assessed to be active since at least September 2024 (day is approximate; source states the month only).
- First observed GitHub comment used to test the C2 mechanism; infrastructure staging begins in November 2025 (Unit 42).
- Blinder Tunnel social-engineering campaign launches in late March 2026 using a Dubai Airports IT recruitment lure against Iraqi critical-infrastructure developers (day approximate).
- GitHub issue 'asasas' created, used for operational logging tests (Unit 42).
- Repository peakyblinders-tm/pubs created, hosting Client.zip with the Blackwood payload and configuration.
- Google Drive-themed phishing URL submitted from Israel; credential harvesting against an Israeli entity continues through May-June 2026.
- US-hosted C2 at locked-ioc-25 observed in July 2026 on Prince of Persia infrastructure (HTTPS and Telegram API), per Semperis as cited by the source (day approximate).
- Compromise of a high-profile individual in Israel and a Kurdistan Region of Iraq government cloud environment begins; activity spans August-October 2026 (Dream Research Labs; day approximate).
- Unit 42 publishes 'Blinder Tunnel Campaign Targets Iraqi Infrastructure' tracking the activity as CL-STA-1178.
- The Hacker News publishes the DarkBlinders report covering the Israel and Iraqi Kurdistan compromises, ShelbyLoader V2, Blackwood and GitHub C2.
Sources cited
- Blinder Tunnel Campaign Targets Iraqi Infrastructure (Unit 42) Unit 42 · Research · 2026-10-06
- Threat Brief: Escalation of Cyber Risk Related to Iran (Unit 42) Unit 42 · Research · 2026-04-17
- Unit 42: Iranian-nexus actor CL-STA-1178 weaponizes developer build tooling in Blinder Tunnel campaign techjacksolutions.com · Blog · 2026-10-06
- DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment The Hacker News · News · 2026-11-02
- Blinder Tunnel Campaign Targets Iraqi Infrastructure (Infrastructure Now) infrastructure-now.co.uk · News · 2026-10-06
More from DarkBlinders
Previous and next in apt
Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.
