DarkBlinders Deploys SHELBYLOADER in Targeted Attacks

The Lure and Delivery

DarkBlinders established initial access through targeted social engineering and deceptive software distribution campaigns. Rather than relying on automated exploits or public vulnerabilities, the operators developed bespoke infrastructure mimicking authentic regional services to deceive victims. The campaign relied on two concurrent delivery vectors designed to extract user credentials and execute custom loader payloads on target endpoints.

Counterfeit Video-Conferencing Software: StarkMeet

The primary payload delivery mechanism involved a counterfeit video-conferencing client branded as StarkMeet. The adversary packaged this application inside an unsigned Inno Setup installer executable distributed through typosquatted domains such as stark-meet.com, starkmeet.com, and stark-meet.online. When executed by an unsuspecting user, the installer deploys a functional graphical application that displays local camera, microphone, and screen-sharing previews to simulate a legitimate meeting client.

The deception operates smoothly until the target attempts to connect to an external session. At this point, the application presents an error message stating that Stark Meet could not reach a meeting server. While the decoy application itself contains no malicious instructions, the underlying installer quietly drops payload files into the victim directory at %LOCALAPPDATA%\Microsoft\RuntimeBroker\ to initiate the execution phase.

AppDomainManager Process Injection

To bypass endpoint detection and response (EDR) tooling, DarkBlinders leveraged AppDomainManager injection. The installer drops a genuine, Microsoft-signed Visual Studio debugging host executable, originally named vshost.exe, renamed to RuntimeBroker.exe. Accompanying this legitimate binary is a malicious dynamic-link library named RuntimeBroker.dll, which serves as SHELBYLOADER V2. When the signed host executes, the .NET runtime hijacks the specified AppDomain manager, loading the malicious DLL directly into memory under the cover of a trusted Microsoft process.

The Credential Harvesting Flow

Parallel to the deployment of the StarkMeet decoy, DarkBlinders maintained an extensive infrastructure of credential phishing portals. These sites impersonated legitimate government webmail services, single sign-on gateways, and commercial cloud storage providers across the region. Organizations defending against these multi-vector intrusions should validate employee resilience through continuous Security Awareness Training, which directly challenges workforce behavior against realistic spoofing lures.

The credential harvesting architecture focused on regional entities, including spoofed Outlook Web App (OWA) and cloud administration portals simulating the Gulf Cooperation Council (GCC) Secretariat General (gcc-sg.cloud), the Kuwait Ministry of Foreign Affairs (mfakuwait.online, mofakuwait.online), and regional cloud administrative endpoints (krgcloud.online). The attackers also registered multiple variations of cloud storage providers, including Google Drive and Microsoft OneDrive impersonations.

When users entered their corporate credentials into these fraudulent forms, the infrastructure captured plaintext passwords and intermediate session tokens. The operators subsequently weaponized these credentials against connected enterprise cloud tenants. In confirmed intrusions, DarkBlinders utilized legitimate administrative access to compromise cloud environments directly, bypassing network boundary defenses and facilitating large-scale espionage operations without requiring code execution within the cloud control plane itself.

Who Is Targeted

Victimology analysis demonstrates that DarkBlinders operates with selective, high-value espionage objectives rather than conducting indiscriminate scanning. Target sectors and confirmed impacts include:

• Regional Government Entities: Intruders successfully compromised a government cloud environment in the Kurdistan Region of Iraq, using harvested administrative access to stage lateral movement and exfiltrate over 1 GB of sensitive organizational data.

• High-Profile Individuals: The threat group specifically targeted senior personnel in Israel associated with strategic sectors, utilizing personalized communication lures to deliver the StarkMeet application.

• Diplomatic and Public Sector Bodies: The extensive registration of GCC and foreign ministry lookalike domains indicates sustained collection efforts directed at regional diplomatic communications, telecommunications providers, and infrastructure entities.

Adversaries demonstrating this degree of persistence frequently challenge defenses beyond surface-level controls. Validating resistance against advanced persistence techniques requires comprehensive Red Team Operations that simulate covert adversary behaviors across physical, network, and human layers.

Detection Signals

Detecting DarkBlinders requires monitoring endpoint behavior, identity provider telemetry, and perimeter network traffic. Because the group leverages legitimate cloud services like GitHub for command-and-control operations, defenders must scrutinize API traffic originating from non-developer systems.

Endpoint and In-Memory Execution Indicators

SHELBYLOADER V2 creates persistence by adding a value named MicrosoftRuntime to the Windows registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, pointing to the dropped executable at %LOCALAPPDATA%\Microsoft\RuntimeBroker\RuntimeBroker.exe. Once running, the loader collects system profiling data, computes a unique 16-character hexadecimal victim identifier derived from the machine name, user SID, and domain, and transmits this reconnaissance profile.

The operators selectively deploy the second-stage payload, SHELBYC2 (RuntimeBrokerApi.dll), by committing an AES-256-CBC decryption key into a private repository. When loaded, SHELBYC2 enforces single-instance execution via a global mutex pattern (Global\<SHA256("GSC" + victim_id)>). It executes remote shell commands using an embedded helper module named PsProxy.dll. This module instantiates an internal PowerShell runspace via System.Management.Automation directly within the host process, executing administrative commands without spawning standalone powershell.exe processes.

Network and Cloud Communication Signals

Defenders should review SIEM, proxy, and DNS telemetry for the following activity patterns:

• Structured GitHub API Beacons: Repeated HTTPS REST queries to api.github.com/repos/PeakyBlindersTeam/myLic (registration) and api.github.com/repos/PeakyBlindersTeam/myCode (tasking) executed by user-space binaries.

• Fallback Proxy Relays: Connections targeting Cloudflare Worker endpoints configured as secondary C2 relays, specifically g-prx.itugegape524.workers.dev/rate_limit.

• PowerShell DLL Loading: EDR alerts for non-administrative processes loading System.Management.Automation.dll or its native image equivalent outside normal developer workflows.

Hardening the Control and the Human

Neutralizing advanced social engineering campaigns requires combining strict identity verification controls with rigorous technical safeguards. Relying solely on perimeter defenses or traditional antivirus signatures provides insufficient protection against living-off-the-land loaders and cloud-hosted dead-drop communications.

Technical Policy Hardening

Enterprise infrastructure teams must implement defensive barriers that restrict unauthorized execution and credential misuse:

• Software Restriction and AppLocker Policies: Prevent executable and DLL execution from user-writable directories such as %LOCALAPPDATA%, %APPDATA%, and %TEMP%. Legitimate administrative software should operate exclusively from protected system paths.

• Egress Inspection and Repository Access Controls: Implement granular proxy rules that inspect connections to developer platforms like GitHub. Where feasible, restrict outbound GitHub API access on standard business endpoints to approved corporate enterprise organizations.

• Phishing-Resistant Multi-Factor Authentication: Transition privileged accounts and cloud administration portals from SMS or standard push notifications to FIDO2/WebAuthn hardware tokens. This mitigates reverse-proxy credential harvesting portals that intercept traditional multi-factor codes.

• Cloud Tenant Auditing: Continuously monitor cloud identity logs for impossible travel patterns, unusual service principal assignments, and bulk data export commands.

Empowering the Human Defender

Because DarkBlinders relies on polished decoy software and regional organizational impersonation, human vigilance remains a critical defensive barrier. Organizations should incorporate campaign-specific indicators into security awareness exercises, training staff to identify deceptive video-conferencing installers, verify diplomatic email headers, and report unexpected software installation prompts immediately. For organizations seeking to uncover unmanaged perimeter exposure before threat actors exploit it, FemtoSec delivers comprehensive Penetration Testing to evaluate organizational resilience against sophisticated real-world tradecraft.