DarkBlinders
DarkBlinders is classified as state-sponsored.
- Type
- State-sponsored
- Origin
- Iran
DarkBlinders hackers are deploying a fake video meeting application to establish a backdoor and facilitate cyberespionage against Israel and the Kurdistan Region of Iraq. Their operations have led to compromises within a government cloud environment in Kurdistan and targeting a significant Israeli individual linked to security. They are also abusing GitHub repositories as part of their TTPs. The investigation has confirmed their focused efforts in this cyber campaign.
The group's reported origin is Iran.
Published reports on this actor:
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.