GINC-APT-0697 · Targeted, sponsor unknown

DarkBlinders

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Iran(high confidence)
Sources
3 sources carry it
Identifier
GINC-APT-0697 · darkblinders

What it is

DarkBlinders hackers are deploying a fake video meeting application to establish a backdoor and facilitate cyberespionage against Israel and the Kurdistan Region of Iraq. Their operations have led to compromises within a government cloud environment in Kurdistan and targeting a significant Israeli individual linked to security. They are also abusing GitHub repositories as part of their TTPs. The investigation has confirmed their focused efforts in this cyber campaign.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • Backdoor.Oldrea
  • CloudDuke
  • Cyber Eye RAT
  • CyberGate

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de