DarkBlinders hackers exploited GitHub repositories to spread malware during a cyberespionage campaign targeting Israel and the Kurdistan Region of Iraq, as revealed by Dream Security. Researchers identified the activity between August and October 2026 and stated it continued after the report was published. The confirmed victims included a government cloud environment in Iraqi Kurdistan and a prominent Israeli security figure.
Their infrastructure also impersonated Kuwait's Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General, indicating a broader interest in government and diplomatic targets. Fake Outlook Web App pages captured usernames and passwords, while imitations of Google Drive pages prompted users to download archives. Its installer presented a normal setup process but immediately led to a connection error upon attempting to join the meeting.
The workflow from analyzing RuntimeBroker.dll to recovering operator tasks (Source: dreamgroup) involved a legitimate, signed executable renamed RuntimeBroker.exe, which loaded RuntimeBroker.dll. Researchers discovered approximately ten initial host registrations, but only two victims were identified in the second stage tasking channel. For selected systems, the loader decrypted RuntimeBrokerApi.dll using AES-256-CBC and loaded it directly into memory without saving the decrypted backdoor to disk.
Researchers recovered decryption material from Git history and examined existing repository contents using read-only access.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
