Iranian espionage group hacked the server of a security official in Israel

Security researchers have uncovered an espionage operation by the Iranian cyber cell DarkBlinders, which hacked the server of a senior security official in Israel using phishing and a fake video call app called StarkMeet. At the same time, the cell breached a government cloud infrastructure in Iraqi Kurdistan.

Security researchers have uncovered an espionage operation by the Iranian cyber cell DarkBlinders, which targeted a high-profile individual linked to Israel's security establishment. According to a report by Dream Research Labs, the attackers used sophisticated social engineering: they set up phishing sites impersonating email and cloud services, and created a fake video call app named StarkMeet. Installing the app planted a backdoor called ShelbyLoader on the victim's device, which communicated with command-and-control servers via GitHub to disguise its activity. Simultaneously, the same cell breached a government cloud infrastructure in Iraqi Kurdistan and stole at least one gigabyte of classified documents. The researchers link DarkBlinders to the APT34 infrastructure of Iranian intelligence. The disclosure comes alongside findings by cybersecurity firm Semperis, which identified command-and-control servers of another Iranian espionage group operating from within the United States. The article concludes with a warning to security officials and technology companies in Israel to be wary of unidentified contacts and avoid downloading software from unfamiliar websites.