Iranian Hackers Target Israeli Defense Sector Server
Translated & summarized from Mignews by baba
An Iranian hacker group called DarkBlinders has infiltrated the digital systems of a senior Israeli defense official using a fake video conferencing app. The attackers employed a technique to bypass firewalls and also created phishing pages to steal passwords. This group is linked to APT34, known for intelligence gathering in the Middle East. Security experts recommend increased vigilance and multi-factor authentication for defense and tech personnel.
The story in 6 lines · by baba
- Iranian hacker group DarkBlinders breached a senior Israeli defense official's digital systems.
- Attackers used a fake video conferencing app and a hidden module to gain access.
- The hackers routed traffic through GitHub to bypass corporate firewalls.
- The group also created phishing pages to steal passwords.
- DarkBlinders is linked to the Iranian intelligence-gathering entity APT34.
- Security experts advise caution with unverified apps and recommend multi-factor authentication.
A cyber group linked to Iran, known as DarkBlinders, has successfully breached the digital systems of a senior official within Israel's defense sector. The attackers gained access to the internal infrastructure by using a fake video conferencing application called StarkMeet, which secretly deployed a control module named ShelbyLoader. Cybersecurity experts, as reported by Channel 14, observed that the hackers routed their command traffic through GitHub, a legitimate development service. This tactic allowed them to bypass corporate firewalls, as network filters interpreted the traffic as normal programmer activity. Additionally, the group established phishing pages mimicking government cloud storage and email systems to steal user passwords. Palo Alto Networks specialists identified a concurrent operation by the same group, where hackers sent malicious programming test assignments to engineers, posing as Dubai Airport's HR department. The cyber unit also compromised the Kurdish autonomous region's government cloud servers in Iraq, downloading over a gigabyte of official documents. Analysts associate DarkBlinders with the prominent Iranian entity APT34, which has a history of gathering intelligence on Middle Eastern government bodies, aviation hubs, and telecommunications firms. Security services are advising personnel in defense and technology companies to avoid downloading unverified communication apps, to scrutinize suspicious contacts, and to implement hardware multi-factor authentication for all work accounts.
