DarkBlinders Shifts to AppDomainManager Injection and GitHub C2 Against Israeli and Kurdish Targets

Dream Research Labs documented credential-harvesting domains mimicking OWA and cloud services alongside StarkMeet decoys that executed ShelbyLoader V2. The chain used .csproj files for AppDomainManager injection, DLL sideloading, and SHELBYC2 callbacks to GitHub repositories for tasking and exfiltration. No code overlap appears with known Iranian clusters tracked by Elastic or Group-IB. Palo Alto Unit 42 previously linked the same infrastructure to fake Dubai Airports recruitment lures that delivered identical payloads to Iraqi targets starting March 2026. The pattern shows iterative refinement of developer-tool abuse rather than new zero-days. Evidence trails from domain registrations, GitHub commit histories, and victim telemetry indicate continued focus on aviation, telecom, and now regional government cloud environments. Official Iranian attribution remains absent; technical indicators point only to operator familiarity with prior REF8685 tooling. Operational significance lies in the low-cost social-engineering pipeline that bypasses ETW monitoring and persists through signed binaries. Next phase likely involves expanded use of Blackwood tunnels for lateral movement inside compromised cloud tenants.