DarkBlinders
DarkBlinders is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Government, and Transportation and Logistics, in 3 countries, including the United Arab Emirates and Israel. It uses 6 MITRE ATT&CK techniques.
- Origin
- Iran
- Techniques
- 6
- Exploited CVEs
- No CVE data
- First seen
- Sep 1, 2024
- Last seen
- Oct 31, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
6 techniques across 4 of 14 tacticsReconnaissance1
Acquire Infrastructure: Domains
Resource Development·
Execution2
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: AppDomainManager
Persistence·
Privilege Escalation·
Defense Evasion1
Web Service
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- SHELBYC2malware
- SHELBYLOADERmalware
Indicators Of Compromise.
TLP:AMBER9 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout DarkBlinders.
Iran state-aligned group that ran a cyber espionage campaign against Israel and the Kurdistan Region of Iraq between August and October 2026, using credential phishing, lookalike cloud and webmail domains and trojanized developer tooling; it delivers SHELBYLOADER via DLL sideloading and AppDomainManager injection to run the SHELBYC2 backdoor over GitHub-based command-and-control.
Last updated Nov 2, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.