In late March, a message reached a high-value target in Iraq from people posing as the IT department of Dubai Airports, operator of Dubai International (DXB), the world's busiest airport for international passengers. A fake careers portal followed. In April came a coding challenge, a Visual Studio project dressed up as a C# test. Opening it was enough. The project carried a malicious build file, and loading the project into Visual Studio ran the adversary's code before the target compiled anything. The code then hijacked a Windows component called AppDomainManager, sideloaded a malicious library, and set a flag meant to weaken Windows event tracing, a built-in security-logging feature. The job was fake. The break-in was real.
Palo Alto Networks' Unit 42 reported the campaign on October 6, naming the activity CL-STA-1178 and rating an Iranian nexus at high confidence. Unit 42 added one caveat. It found no breach, compromise, or vulnerability inside Dubai Airports. The airport's name was only the lure. Two days later, on October 8, a second firm, Dream, published its own report. Dream tied the same tradecraft to a wider body of activity it calls DarkBlinders, including an August-to-October campaign against a security-sector individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. One operation had drawn two names from two firms in a single week, and more were already attached to it.
The group earned its first name from its own malware. In March 2025, Elastic Security Labs documented a malware family it called SHELBY and filed it under an internal tracking label, REF8685. Elastic drew the name SHELBY from the threat actor's own Peaky Blinders theming. They had littered their infrastructure with references to the Shelby brothers of the television series. One of their domains read arthurshelby[.]click. A GitHub account went by PeakyBlindersTeam. When Dream later named the group DarkBlinders, it was keeping the theme they had started.
SHELBY comes in two parts, a first-stage loader and a backdoor it installs to take commands and steal data. The unusual part is how the backdoor communicates. Instead of calling home to a dedicated server a security team could spot and block, it hides its command-and-control inside GitHub, the code-hosting service developers use every day. The backdoor writes stolen data into a private GitHub repository and reads its orders from files left there. GitHub is useful, trusted, and everywhere, so almost no organization blocks it, and the malware's traffic looks like a developer pushing code rather than a break-in underway.
The early version had a glaring weakness. The GitHub personal access token controlling access to the repository was hard-coded into the malware. Anyone who pulled it out gained the same control over infected machines DarkBlinders had, and could read the repository the whole operation ran on. The sloppiness sat oddly beside the care DarkBlinders showed everywhere else, and a hard-coded key like this is the rare mistake a watchful defender can turn against the adversary.
By 2026 the group was running two different lures into the same kind of malware. One, documented by Unit 42, was the fake coding challenge. Opening the malicious project set off the AppDomainManager hijack and the sideloaded library, and ended in a tool called Blackwood, which built a tunnel out of the network using Chisel, an open-source utility, to give DarkBlinders covert remote access.
The other lure, documented by Dream, was StarkMeet, a fake video-meeting app whose join button never works. Behind the dead button, it quietly installs a loader and a backdoor disguised as ordinary Windows files, RuntimeBroker.dll and RuntimeBrokerApi.dll. Both lures preserve the same GitHub-centered control architecture found in newer versions of the SHELBY loader and backdoor Elastic first described in 2025. In the StarkMeet branch, a Cloudflare Worker provides a backup relay if direct GitHub access fails.
The newer waves are also more disciplined. The backdoor's real payload stays encrypted and dormant until DarkBlinders supplies a key matched to the individual host. Run the sample in a sandbox or on an analyst's bench and nothing happens, because the second stage never unlocks. Dream watched about ten machines check in, but only two were ever switched on. DarkBlinders was selecting its targets and discarding most of what it caught. The operators built selection into the deployment chain, frustrating casual analysis and keeping the real payload out of every hand except a chosen victim's.
By now the same operational lineage had collected a crowd of names, worth listing in full. Elastic filed the activity as REF8685, an activity cluster built around the intrusion it observed. Palo Alto Networks' Unit 42 called its slice CL-STA-1178. Group-IB and Dream both named the adversary DarkBlinders. Zscaler, watching a related operation impersonating Iraq's Ministry of Foreign Affairs, named it Dust Specter in March 2026. Mandiant logged two more under its uncategorized labels, UNC5795 and UNC5187, the tag it uses for activity it has not yet tied to a known group.
Seven labels for one operational lineage looks like the industry tripping over itself, but each name is really a different firm's partial view. No two companies see the same slice of an intrusion, and Google, which runs the uncategorized system, says plainly comparing one vendor's clusters to another's is rarely clean. Each name marks how much of the operation one firm could see, and from where.
The confidence levels follow the same pattern. Group-IB, the most cautious, rates the Iranian link low and finds no firm tie to any known group. Unit 42, looking at one well-mapped campaign, rates its own cluster Iranian at high confidence. Dream, seeing the most, goes furthest. It places DarkBlinders alongside UNC5795 and Dust Specter at medium-to-high confidence, and links UNC5795, at medium confidence, to the Iranian adversary CrowdStrike tracks as HELIX KITTEN (aka OilRig, APT34). Dream's Iranian assessment rests on the infrastructure and malware relationships tying those clusters together, reinforced by victimology and existing attribution research. The Persian keyboard setting and Iranian hosting provide supporting context rather than the foundation of the assessment.
Dream is not the only firm reaching toward APT34. Mandiant gives UNC5187 moderate-confidence ties to the group, and Recorded Future links Dust Specter to TAG-135, one of its own APT34 subclusters. Several teams reach the same Iranian adversary from different evidence, which is the strongest argument for the connection. It is also an indirect argument, a chain of medium- and moderate-confidence links passing through in-between clusters, with no clean identification anywhere in it, and Elastic never attributed the original malware to anyone. The Iranian nexus is solid. The specific family tree is not, and closing the gap by assertion would be easy and wrong. The gap costs something real. On the public evidence alone, the chain remains too soft to collapse DarkBlinders into HELIX KITTEN with the confidence a formal public attribution would demand. A government may hold classified evidence the vendors do not. Naming moves slower than the theft.
The victims line up. Group-IB traces DarkBlinders back to September 2024, with confirmed campaigns against UAE aviation and Iraqi telecommunications in January and February 2025, and reads the activity as espionage rather than financially motivated eCrime because nothing was ever ransomed or extorted. Dream's 2026 reporting adds the two newest victims, the security-sector individual in Israel and the Kurdistan government cloud, where it confirmed stolen credentials and at least a gigabyte of exfiltrated data.
The map of victims reads as Tehran's priority list, and the Kurdistan Region of Iraq sits at the top of it. Two Iranian problems meet there. The region hosts Iranian Kurdish opposition parties like the Kurdistan Democratic Party of Iran and Komala. Tehran treats them as an armed threat on its border and has hit them repeatedly, even after a 2023 deal with Baghdad to disarm and move them. The region also keeps a long relationship with Israel, which Tehran sees as an enemy intelligence foothold next door.
In January 2024 Iran fired ballistic missiles at Erbil, claiming it had struck an Israeli spy site. The Kurdish government said no such site existed. Seen this way, the Kurdish government cloud and the Israeli security official are the two halves of one Iranian intelligence problem. The Gulf aviation and telecom targets fill in the rest, the ordinary travel, movement, and communications intelligence any state service wants.
Set the pieces beside each other and the operation comes into focus. A patient Iranian effort has spent two years refining a single playbook. Lure a target with a fake job or a fake meeting, and hide inside GitHub traffic so no one blocks communication. Then wake the malware only for the victims it wants, and pull intelligence from exactly the places Tehran cares about, including a Kurdistan Regional Government environment and an Israeli security figure.
Several security firms have each caught a piece of it. None can yet prove the whole, and none can collapse the public evidence into a definitive identification of the adversary behind every cluster.
The operation keeps running in the space between what the industry can see and what it can prove. The fake recruiter, the dead meeting app, the scattered cluster names, the Kurdish cloud, and the gigabytes already gone all belong to one operational lineage, still collecting, while its watchers are still deciding what to call it.