# DarkBlinders (CL-STA-1178 / REF8685, Iran state-aligned) Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment via ShelbyLoader V2, Blackwood and GitHub C2

> DarkBlinders, an Iran state-aligned actor active since at least September 2024, compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq between August and October 2026. The campaign uses SHELBYLOADER/SHELBYC2 (including ShelbyLoader V2), the Blackwood Chisel-based tunneling utility and a Tornado/Tonnerre variant, delivered via spear-phishing, trojanized utilities and fake coding assessments, with GitHub abused for C2 and exfiltration.

- **Published:** 2026-11-02T15:10:55Z
- **Last reviewed:** 2026-11-02T15:10:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5063
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5063.png
- **ID:** TL-2026-5063
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** DarkBlinders (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

DarkBlinders is an Iran-nexus cluster assessed to be active since at least September 2024 and previously linked to attacks on aviation infrastructure and telecommunications in the UAE and Iraq. Palo Alto Networks Unit 42 tracks the activity as CL-STA-1178 and Elastic Security Labs tracks the SHELBYLOADER cluster as REF8685. According to a Dream Research Labs report summarized by The Hacker News on 2026-11-02, the actor compromised a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq between August and October 2026. Other vendors credited in the coverage are Group-IB, Semperis and Google Cloud Community. Overlaps are reported with UNC5795 (Google Cloud Community assessment), Dust Specter and, at medium confidence, APT34 sub-clusters.

Initial access relies on social engineering. Reported lures include spear-phishing with trojanized utilities, lookalike credential-phishing pages (Outlook Web Access-style logon pages and cloud-drive pages on gcc-sg.cloud, mfakuwait.online and moelcloud.online), a fake StarkMeet videoconferencing application hosted on stark-meet domains, and fake recruitment impersonating the Dubai Airports IT department. In the Unit 42 'Blinder Tunnel' analysis (published 2026-10-06), victims first receive an Inno Setup-packaged offline career portal with a decoy 10-question HR questionnaire that executes nothing malicious. They are then sent a weaponized Visual Studio coding challenge (DubaiAirport_Carrers_IT_Test.zip). It contains a personalized Readme.md, a C# Flight Management System with an intentional bug, and a malicious FlightManager.csproj that hijacks the GetFrameworkPaths target. The target runs during Visual Studio's background design-time build, so no user action beyond opening the project is needed.

The .csproj copies binaries from the project's Resources folder to %LOCALAPPDATA%\Microsoft\RuntimeBrokers and launches a renamed legitimate RuntimeBroker.exe. A modified RuntimeBroker.exe.config injects a malicious AppDomainManager before the host process initializes and sets etwEnable to false, which disables Event Tracing for Windows. A DLL search-order hijack then loads the malicious RuntimeBroker.dll, which is ShelbyLoader V2 (also tracked as HOTAIR). The loader fingerprints the host and checks for virtualization markers in WMI, processes, registry keys and files. It persists through the HKCU Run value MicrosoftRuntime, beacons every 63 seconds, and authenticates to GitHub with a hard-coded Personal Access Token. PsProxy.dll runs PowerShell in memory through a hidden runspace on System.Management.Automation.dll without spawning powershell.exe. ShelbyC2 V2 (RuntimeBrokerApi.dll, also tracked as AEROSTAT) is the RAT. It decrypts with AES-CBC using the SHA-256 of 'license' content fetched from GitHub, executes commands via PsProxy, and stages Blackwood.

GitHub is the C2 and exfiltration channel. The account peakyblinders-tm and repository myLic hold per-machine files: Base64-encoded fingerprints go to /{machineId}/Lic.txt and tasks are read from /{machineId}/Inf.txt, with a one-hour sleep on HTTP 403. If the token is revoked or returns HTTP 401, the implant falls back to the GitHub Issues Search API using date-based (yyyymmdd) queries. It reads AES-256-CBC ciphertext hidden in HTML comment markers; the key is derived from MD5(date + machineId), and the decrypted data carries updated Owner, LicRepo and LicToken values. Blackwood is a zero-disk tunneling utility wrapping the open-source Chisel tool. It is embedded as an 8.4 MB manifest resource (Blackwood.Cheese.xml) encrypted with AES-256-CBC, its config is RC4-encrypted, and it uses the same AppDomainManager and DLL-sideloading deployment pattern. Blackwood tunnel endpoints include 91.107.156.29, 87.248.129.239 and 65.109.214.145. A Blackwood payload archive (Client.zip) was hosted in the peakyblinders-tm/pubs repository, created 2026-05-01.

Semperis reporting cited by the source describes a Tornado/Tonnerre variant used as second-stage C2 on Prince of Persia infrastructure at 68.65.122.203 (US-hosted, July 2026) over HTTPS and the Telegram API, the first US-based C2 in roughly a decade of that operation. Attribution to Iran rests on Iranian ISP hosting for Blackwood endpoints, Persian-language domain resolution, MP3 metadata pointing to the Iranian site MusicDel.ir, regional victimology and tradecraft overlaps with Screening Serpens/UNC1549 (AppDomainManager hijacking with ETW disabling) and Agent Serpens/APT35 (GitHub dead-drop resolvers, in-memory .NET PowerShell wrappers). No CVE or CVSS is associated with this campaign; it abuses legitimate developer tooling and trusted platforms rather than a software vulnerability.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1127 Trusted Developer Utilities Proxy Execution
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.014 Hijack Execution Flow: AppDomainManager
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1132.001 Data Encoding: Standard Encoding
- T1008 Fallback Channels
- T1572 Protocol Tunneling
- T1583.001 Acquire Infrastructure: Domains

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**DarkBlinders ShelbyLoader V2 Sideload Staging in RuntimeBrokers Directory (Exploitation)** (`TL-2026-5063-SPL-001`)

Detects Sysmon file-creation events that stage the ShelbyLoader V2 (HOTAIR) / ShelbyC2 (AEROSTAT) sideload set in the user-writable %LOCALAPPDATA%\Microsoft\RuntimeBrokers directory: a renamed RuntimeBroker.exe host, a modified RuntimeBroker.exe.config (AppDomainManager injection with etwEnable=false), RuntimeBroker.dll, RuntimeBrokerApi.dll and PsProxy.dll. The legitimate RuntimeBroker.exe lives only in System32, so any write to a 'RuntimeBrokers' folder is high fidelity. Part of the DarkBlinders (CL-STA-1178 / REF8685) Blinder Tunnel campaign, TL-2026-5063.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.014, T1574.001, T1562.006, T1036.005
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceFileEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*RuntimeBrokers*" (TargetFilename="*RuntimeBroker.exe.config" OR TargetFilename="*RuntimeBroker.exe" OR TargetFilename="*RuntimeBroker.dll" OR TargetFilename="*RuntimeBrokerApi.dll" OR TargetFilename="*PsProxy.dll") | eval writer=lower(Image) | stats min(_time) as first_seen max(_time) as last_seen dc(TargetFilename) as distinct_files values(TargetFilename) as dropped_files values(writer) as writer_processes by host User | where distinct_files>=2 OR match(mvjoin(dropped_files,"|"),"(?i)exe[.]config") | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has "RuntimeBrokers"
| where FileName in~ ("RuntimeBroker.exe.config", "RuntimeBroker.exe", "RuntimeBroker.dll", "RuntimeBrokerApi.dll", "PsProxy.dll")
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), FileCount = dcount(FileName), DroppedFiles = make_set(FileName), Writers = make_set(InitiatingProcessFileName) by DeviceName, InitiatingProcessAccountName
| where FileCount >= 2 or tostring(DroppedFiles) has "RuntimeBroker.exe.config"
```

### Sigma

```yaml
title: DarkBlinders ShelbyLoader V2 Sideload Staging in RuntimeBrokers Directory
id: 7d2a41c8-3b59-4e0f-a6c1-9f8e5b1d2c01
status: experimental
description: Detects creation of the ShelbyLoader V2 / ShelbyC2 sideload set (RuntimeBroker.exe, RuntimeBroker.exe.config, RuntimeBroker.dll, RuntimeBrokerApi.dll, PsProxy.dll) inside the user-writable Microsoft\RuntimeBrokers directory, as used by DarkBlinders (CL-STA-1178 / REF8685) in the Blinder Tunnel campaign.
references:
    - https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
    - https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html
author: Threadlinqs Team
date: 2026-11-02
tags:
    - attack.persistence
    - attack.t1574.014
    - attack.t1574.001
    - attack.defense-evasion
    - attack.t1562.006
    - attack.t1036.005
logsource:
    category: file_event
    product: windows
detection:
    selection_dir:
        TargetFilename|contains: '\Microsoft\RuntimeBrokers\'
    selection_files:
        TargetFilename|endswith:
            - '\RuntimeBroker.exe.config'
            - '\RuntimeBroker.exe'
            - '\RuntimeBroker.dll'
            - '\RuntimeBrokerApi.dll'
            - '\PsProxy.dll'
    condition: selection_dir and selection_files
falsepositives:
    - Unlikely; the genuine RuntimeBroker.exe is only installed under C:\Windows\System32
level: high
```

**Known false positives:**

- Software that legitimately creates a folder named RuntimeBrokers in a user profile (rare, none known)
- Red-team or malware-analysis sandboxes replaying the Blinder Tunnel sample

**Tuning notes:** Change the index/sourcetype to match your Sysmon ingestion (requires Sysmon EventCode 11 FileCreate logging). Exclude analyst sandbox hosts by host name. The distinct_files threshold can be lowered to 1 for a stricter posture.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Visual Studio / MSBuild Design-Time Build Launching RuntimeBroker from User Profile (Exploitation) (locked: unlock with TL Creds)
- DarkBlinders PsProxy In-Memory PowerShell Runspace and Sideloaded Implant DLLs (Post-Exploitation) (locked: unlock with TL Creds)
- DarkBlinders Blackwood Chisel Tunnel and Tornado/Tonnerre C2 Connections (C2 / Tunneling) (locked: unlock with TL Creds)
- DarkBlinders Phishing and StarkMeet Lure Domain Resolution (Exploitation / Initial Access) (locked: unlock with TL Creds)
- Masqueraded RuntimeBroker.exe Executing Outside System32 (Post-Exploitation) (locked: unlock with TL Creds)
- DarkBlinders GitHub Repo C2 and Issues Search Fallback Channel (C2) (locked: unlock with TL Creds)
- DarkBlinders ShelbyLoader V2 MicrosoftRuntime Run Key Persistence (Post-Exploitation) (locked: unlock with TL Creds)
- DarkBlinders GitHub Dead-Drop C2 DNS Activity from Non-Browser Process (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `68.65.122[.]203`
- Domain: `gcc-sg[.]cloud`
- File hash: `53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment](https://thehackernews.com/2026/11/darkblinders-compromises-israeli-target.html)
- [Blinder Tunnel Campaign Targets Iraqi Infrastructure (Unit 42)](https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/)
- [Unit 42: Iranian-nexus actor CL-STA-1178 weaponizes developer build tooling in Blinder Tunnel campaign](https://techjacksolutions.com/scc-intel/unit-42-iranian-nexus-actor-cl-sta-1178-weaponizes-developer-build-tooling-in-blinder-tunnel-campaign-against-iraqi-critical-infrastructure/)
- [Blinder Tunnel Campaign Targets Iraqi Infrastructure (Infrastructure Now)](https://www.infrastructure-now.co.uk/article/493801/blinder-tunnel-campaign-targets-iraqi-infrastructure)
- [Threat Brief: Escalation of Cyber Risk Related to Iran (Unit 42)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5063