DarkBlinders: Active Espionage Campaign

The report

Dream uncovered an active DarkBlinders espionage campaign against Israel and the Kurdistan Region of Iraq, linking the activity to UNC5795, Dust Specter, and APT34 through GitHub-based command and control.

Read the full analysis: DarkBlinders: Active Espionage Campaign (dreamgroup.com).

Indicators

Malware C

• g-prx[.]itugegape524[.]workers[.]dev

Phishing

• accountmeetgooge[.]online
• cdn-gdrive[.]cloud
• cdndrive[.]online
• drive-g[.]cloud
• drive-go[.]cam
• drive-googe[.]online
• drivegooge[.]online
• gcc-sg[.]cloud
• gcc-sg[.]online
• googedrive[.]online
• googemeet[.]online
• gsecurity[.]help
• korektell[.]com
• krgcloud[.]online
• meet-goo[.]cam
• meetcloud[.]site
• meetgooge[.]cam
• meetgooge[.]online
• meetlogin[.]online
• meetonline[.]cam
• mfakuwait[.]online
• mfakuwait[.]org
• mfakuwait[.]website
• moelcloud[.]online
• mofakuwait[.]online
• msonedrive[.]cloud
• secure-googe[.]help
• stark-meet[.]com
• stark-meet[.]online
• stark-meet[.]website
• starkmeet[.]com

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#8). This page is generated from that record and the report’s own title and summary; nothing is rewritten.