Iranian-Linked Espionage Campaign Breached Kurdistan Government Cloud

An Iranian-linked cyberespionage operation breached a government cloud environment in Iraq's Kurdistan Region and exfiltrated at least 1 GB of data, according to new research from Dream.

The campaign, tracked as DarkBlinders or Blinder Tunnel, used counterfeit government webmail, cloud-drive services, credential phishing and a fake meeting application called StarkMeet. Dream said StarkMeet could leave malware behind even after the visible application was removed.

Operators appeared selective. Roughly 10 systems checked in to the initial infrastructure, while only two victims appeared in a second-stage tasking channel. The more capable backdoor could run PowerShell commands and transfer files. Dream also identified an Israeli individual associated with the security sector among the victims.

Dream attributed the activity to an Iranian threat actor with high confidence, while its links to specific tracked clusters carried lower confidence. Government and critical-infrastructure defenders should monitor fake collaboration tools, GitHub-based command channels, unusual PowerShell execution and credential-phishing domains that impersonate regional institutions.