Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
DarkBlinders is an active cyberespionage campaign targeting government and diplomatic organizations in Israel and the Kurdistan Region of Iraq. The threat actor relies on sophisticated phishing lures, including fake video-meeting applications and replicas of cloud-drive services, to deploy custom malware. The operation also leverages GitHub repositories for command-and-control (C2) and uses selective activation for its second-stage backdoor.
Investigation
Dream Research Labs conducted an in-depth analysis of the DarkBlinders campaign and uncovered a multi-stage infection chain involving a decoy application called StarkMeet. Researchers reverse-engineered the malware and obtained read-only access to the threat actor’s GitHub-based C2 infrastructure. This visibility enabled them to identify victim tasking and observe the exfiltration of more than 1 GB of data from a government cloud environment.
Mitigation
Organizations should enforce strict controls on unverified software installations and monitor unusual outbound connections to shared services such as GitHub from non-developer systems. Increased scrutiny of cloud-drive sharing links and suspicious email attachments is also recommended. Monitoring unauthorized PowerShell execution through AppDomainManager or in-memory loading can further help identify activity associated with this loader technique.
Response
When DarkBlinders activity is detected, isolate affected hosts to stop further data exfiltration and preserve memory for forensic examination of in-memory payloads. Review GitHub personal access tokens and repository access logs if suspicious activity involves the organization’s development environment. Reset credentials for all accounts that may have been exposed through the identified phishing infrastructure.
Attack Flow
Detections
System Processes Execution from Untypical Paths (via process_creation)
Suspicious Process Utilizes a URL in the Command Line (via cmdline)
Suspicious CURL Usage (via cmdline)
Possible Github File Downloading Initiated By Unusual Process (via network_connection)
Suspicious Files in Public User Profile (via file_event)
Possible Cloudflare Development Domain Abuse (via dns)
Suspicious Command and Control by Unusual Top Level Domain (TLD) DNS Request (via dns)
IOCs (HashSha256) to detect: DarkBlinders: Inside An Active Espionage Campaign Part 2
IOCs (HashSha256) to detect: DarkBlinders: Inside An Active Espionage Campaign Part 1
IOCs (HashMd5) to detect: DarkBlinders: Inside An Active Espionage Campaign
IOCs (SourceIP) to detect: DarkBlinders: Inside An Active Espionage Campaign
IOCs (DestinationIP) to detect: DarkBlinders: Inside An Active Espionage Campaign
DarkBlinders C2 Activity via GitHub and Cloudflare Workers [Windows Network Connection]
Detection of DarkBlinders Campaign Components [Windows Process Creation]
Simulation Execution
-
Attack Narrative & Commands: The adversary aims to establish persistence and remote access using the DarkBlinders toolkit. After gaining initial access, the attacker deploys a decoy application named
StarkMeet.exe. To evade detection, the attacker’s malware executes a shell command to download further payloads. In this simulation, we will manually create a dummyStarkMeet.exeand trigger it to executecmd.exe, which matches the rule’s logic:(StarkMeet.exe) AND (cmd). -
Regression Test Script:
# Simulation Script: DarkBlinders Component Trigger # 1. Create a dummy file to represent the DarkBlinders component $dummyPath = "$env:TEMPStarkMeet.exe" New-Item -Path $dummyPath -ItemType File -Force # 2. Use a small payload to make the 'executable' actually run a command # For simulation purposes, we will use a PowerShell wrapper to launch the 'malicious' process # that mimics the behavior of the component calling cmd.exe. Write-Host "[+] Simulating DarkBlinders component execution..." # We use Start-Process to simulate the StarkMeet.exe process spawning cmd.exe # Note: In a real scenario, the binary itself would perform the spawn. # To trigger the Sigma rule's specific 'Image' logic, we must rename a process or # simulate the execution of that specific filename. # Because we cannot easily compile a real binary here, we simulate the process creation # event that Sysmon would see when StarkMeet.exe runs cmd.exe. Start-Process -FilePath "$env:TEMPStarkMeet.exe" -ArgumentList "cmd.exe /c echo 'Triggering Detection'" -ErrorAction SilentlyContinue # Since we can't actually 'run' a non-binary file, we use this command to create # the exact telemetry pattern via a simulated process creation if possible, # or simply acknowledge that for the rule to trigger, the file must exist. # REALISTIC APPROACH FOR TEST: # We will create a tiny executable or use a known way to name a process. # For this script, we assume the environment allows us to rename a system tool to StarkMeet.exe Copy-Item "C:WindowsSystem32cmd.exe" -Destination "$env:TEMPStarkMeet.exe" Start-Process -FilePath "$env:TEMPStarkMeet.exe" -ArgumentList "/c echo DetectionTriggered" Write-Host "[+] Simulation command sent. Check SIEM for StarkMeet.exe + cmd/powershell." -
Cleanup Commands:
# Cleanup simulation artifacts Remove-Item -Path "$env:TEMPStarkMeet.exe" -Force -ErrorAction SilentlyContinue Write-Host "[+] Cleanup complete."
