{"id":2109,"date":"2026-10-12T07:20:27","date_gmt":"2026-10-12T00:20:27","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-darkblinders-ung-dung-hop-gia-starkmeet-gian-diep\/"},"modified":"2026-10-12T07:20:27","modified_gmt":"2026-10-12T00:20:27","slug":"darkblinders-profile-fake-starkmeet-app-opens-door-to-espionage-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-darkblinders-ung-dung-hop-gia-starkmeet-gian-diep\/","title":{"rendered":"DarkBlinders Profile: Fake StarkMeet App Opens the Door to Espionage"},"content":{"rendered":"

DarkBlinders<\/strong> \u0111ang v\u1eadn h\u00e0nh m\u1ed9t chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eafm v\u00e0o Israel v\u00e0 Khu v\u1ef1c Kurdistan c\u1ee7a Iraq b\u1eb1ng c\u00e1c trang \u0111\u0103ng nh\u1eadp gi\u1ea3, d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef \u0111\u00e1m m\u00e2y nh\u00e1i v\u00e0 m\u1ed9t \u1ee9ng d\u1ee5ng h\u1ecdp video gi\u1ea3 mang t\u00ean StarkMeet. B\u00e1o c\u00e1o c\u1ee7a Dream Research Labs c\u00f4ng b\u1ed1 ng\u00e0y 8\/10\/2026 cho bi\u1ebft chi\u1ebfn d\u1ecbch \u0111\u01b0\u1ee3c quan s\u00e1t t\u1eeb th\u00e1ng 8 \u0111\u1ebfn th\u00e1ng 10\/2026 v\u00e0 v\u1eabn ho\u1ea1t \u0111\u1ed9ng t\u1ea1i th\u1eddi \u0111i\u1ec3m c\u00f4ng b\u1ed1.<\/p>\n

\"DarkBlinders
The fake StarkMeet installer serves as cover for the infection chain. Image: Dream Research Labs.<\/figcaption><\/figure>\n

A Campaign Combining Credential Theft and Malware Installation<\/h2>\n

DarkBlinders does not rely on a single technique. The group built Outlook Web App pages impersonating Kuwait's Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General to collect usernames and passwords. In parallel, Google Drive lookalike domains lured victims into downloading attacker-controlled ZIP files.<\/p>\n

The StarkMeet branch appears to be ordinary online-meeting software. Its installer presents a credible setup interface, while the decoy application offers local camera, microphone, and screen-sharing previews. However, the Join button always returns a fixed error as malicious components are installed separately under a RuntimeBroker directory.<\/p>\n

From Infected Host to Selectively Activated Backdoor<\/h2>\n

The execution chain uses a legitimate signed .NET binary renamed RuntimeBroker.exe to load RuntimeBroker.dll. The malware persists through a Run key in the user's profile and collects system details including machine name, domain, time zone, keyboard layouts, persistence status, and analysis-environment indicators.<\/p>\n

Th\u00f4ng tin n\u00e0y \u0111\u01b0\u1ee3c g\u1eedi t\u1edbi kho GitHub myLic<\/code> d\u01b0\u1edbi t\u00e0i kho\u1ea3n PeakyBlindersTeam. Nh\u00e0 \u0111i\u1ec1u h\u00e0nh xem x\u00e9t t\u1eebng m\u00e1y tr\u01b0\u1edbc khi cung c\u1ea5p v\u1eadt li\u1ec7u k\u00edch ho\u1ea1t ri\u00eang. Dream quan s\u00e1t kho\u1ea3ng m\u01b0\u1eddi m\u00e1y \u0111\u0103ng k\u00fd ban \u0111\u1ea7u nh\u01b0ng ch\u1ec9 hai n\u1ea1n nh\u00e2n xu\u1ea5t hi\u1ec7n trong k\u00eanh t\u00e1c v\u1ee5 giai \u0111o\u1ea1n hai, cho th\u1ea5y backdoor \u0111\u01b0\u1ee3c b\u1eadt c\u00f3 ch\u1ecdn l\u1ecdc thay v\u00ec t\u1ef1 \u0111\u1ed9ng tr\u00ean m\u1ecdi h\u1ec7 th\u1ed1ng.<\/p>\n

GitHub Becomes Command-and-Control Infrastructure<\/h2>\n

RuntimeBroker.dll ch\u1ee9a token truy c\u1eadp GitHub v\u00e0 \u0111\u01b0\u1eddng d\u1eabn t\u1edbi kho myLic<\/code>. M\u1ed9t phi\u00ean b\u1ea3n l\u1ecbch s\u1eed c\u1ee7a t\u1ec7p Lic.txt c\u00f2n gi\u1eef d\u1eef li\u1ec7u d\u00f9ng \u0111\u1ec3 t\u1ea1o kh\u00f3a AES-256-CBC, cho ph\u00e9p gi\u1ea3i m\u00e3 RuntimeBrokerApi.dll. Th\u00e0nh ph\u1ea7n giai \u0111o\u1ea1n hai \u0111\u01b0\u1ee3c n\u1ea1p th\u1eb3ng v\u00e0o b\u1ed9 nh\u1edb, gi\u1ea3m kh\u1ea3 n\u0103ng m\u1eabu r\u00f5 b\u1ecb thu th\u1eadp t\u1eeb \u1ed5 \u0111\u0129a.<\/p>\n

Backdoor sau \u0111\u00f3 li\u00ean l\u1ea1c v\u1edbi kho myCode<\/code> b\u1eb1ng token th\u1ee9 hai, l\u1ea5y l\u1ec7nh kho\u1ea3ng 63 gi\u00e2y m\u1ed9t l\u1ea7n v\u00e0 g\u1eedi k\u1ebft qu\u1ea3 tr\u1edf l\u1ea1i GitHub. N\u00f3 c\u00f3 th\u1ec3 ch\u1ea1y PowerShell trong ti\u1ebfn tr\u00ecnh hi\u1ec7n t\u1ea1i, t\u1ea3i l\u00ean ho\u1eb7c t\u1ea3i xu\u1ed1ng t\u1ec7p, t\u1ea3i v\u00e0 gi\u1ea3i n\u00e9n t\u1ec7p ZIP, \u0111\u1ed3ng th\u1eddi ki\u1ec3m tra h\u1ea1n m\u1ee9c API. M\u1ed9t Cloudflare Worker \u0111\u00f3ng vai tr\u00f2 k\u00eanh chuy\u1ec3n ti\u1ebfp d\u1ef1 ph\u00f2ng.<\/p>\n

A Notable Credential-Rotation Mechanism<\/h2>\n

To survive token revocation or repository takedown, the malware searches public comments in the Microsoft\/vscode repository. A hidden HTML comment block, when correctly structured and successfully decrypted through multiple layers, can provide a new repository owner, repository name, and token. This mechanism turns a trusted public platform into a recovery noticeboard for the command infrastructure.<\/p>\n

The use of GitHub does not mean the malicious activity is affiliated with the platform. Abusing a legitimate service lets traffic blend into normal activity while benefiting from HTTPS and highly available infrastructure, thereby increasing the cost of detection and blocking.<\/p>\n

Confirmed Victims and Impact<\/h2>\n

Dream says it confirmed the compromise of a prominent individual in Israel associated with the security sector and a government cloud environment in the Kurdistan Region. Post-compromise activity included credential theft and the exfiltration of at least 1 GB of data from the government cloud environment.<\/p>\n

The phishing infrastructure also impersonated diplomatic bodies in Kuwait and the Gulf Cooperation Council, suggesting that intended targeting may extend beyond the confirmed victims. Infrastructure traces indicate intent or preparation, however, and should not be interpreted as proof that every impersonated organization was compromised.<\/p>\n

Connections to APT34<\/h2>\n

Dream assesses with medium-to-high confidence that DarkBlinders belongs to the same activity cluster as UNC5795 and Dust Specter. Shared infrastructure, overlapping victimology, and prior attribution research also suggest, with medium confidence, that this cluster and UNC5187 may be related subclusters within the Iran-linked APT34 ecosystem.<\/p>\n

This is an attribution assessment, not an absolute conclusion. Different vendor group names can describe overlapping portions of the same ecosystem, so defenders should prioritize behavior, infrastructure, and technical indicators.<\/p>\n

Defensive Signals to Prioritize<\/h2>\n
    \n
  • Gi\u00e1m s\u00e1t ti\u1ebfn tr\u00ecnh c\u00f3 t\u00ean RuntimeBroker ch\u1ea1y t\u1eeb %LOCALAPPDATA%\\Microsoft\\RuntimeBroker<\/code>, thay v\u00ec v\u1ecb tr\u00ed h\u1ec7 th\u1ed1ng Windows th\u00f4ng th\u01b0\u1eddng.<\/li>\n
  • R\u00e0 so\u00e1t gi\u00e1 tr\u1ecb MicrosoftRuntime<\/code> trong kh\u00f3a Run c\u1ee7a ng\u01b0\u1eddi d\u00f9ng v\u00e0 c\u00e1c ti\u1ebfn tr\u00ecnh .NET t\u1ea3i System.Management.Automation nh\u01b0ng kh\u00f4ng sinh ti\u1ebfn tr\u00ecnh powershell.exe.<\/li>\n
  • Analyze unusual periodic access to the GitHub API, especially from workstations with no software-development requirement.<\/li>\n
  • Check for domains resembling organizational webmail, cloud-storage, or meeting services, and require installation invitations to be verified through an independent channel.<\/li>\n
  • Revoke sessions, rotate credentials, and inspect cloud data when a fake OWA page is detected, even if the endpoint has not generated a malware alert.<\/li>\n<\/ul>\n

    Lessons from the DarkBlinders Campaign<\/h2>\n

    The campaign shows how the line between credential phishing and endpoint compromise is fading. A familiar interface can simultaneously steal accounts, persuade users to run software, and establish long-term persistence. Effective defense therefore requires identity protection, endpoint monitoring, analysis of traffic to code-hosting services, and procedures for verifying meeting invitations.<\/p>\n

    For government and diplomatic organizations, classifying privileged accounts, restricting long-lived tokens, deploying phishing-resistant authentication, and monitoring bulk data downloads are especially important. Meeting applications delivered outside official distribution channels should be treated as high risk, even when their interfaces appear convincing.<\/p>\n

    VNCyberS<\/strong> compiled from Dream Research Labs<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    DarkBlinders \u0111ang v\u1eadn h\u00e0nh m\u1ed9t chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eafm v\u00e0o Israel v\u00e0 Khu v\u1ef1c Kurdistan c\u1ee7a Iraq b\u1eb1ng c\u00e1c trang \u0111\u0103ng nh\u1eadp gi\u1ea3, d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef \u0111\u00e1m m\u00e2y nh\u00e1i v\u00e0 m\u1ed9t \u1ee9ng d\u1ee5ng h\u1ecdp video gi\u1ea3 mang t\u00ean StarkMeet. B\u00e1o c\u00e1o c\u1ee7a Dream Research Labs c\u00f4ng b\u1ed1 ng\u00e0y 8\/10\/2026 cho bi\u1ebft chi\u1ebfn […]<\/p>\n","protected":false},"author":2,"featured_media":2108,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[943,941,945,201,843,946,38,942,944],"class_list":["post-2109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt34","tag-darkblinders","tag-dust-specter","tag-gian-diep-mang","tag-github-c2","tag-kurdistan","tag-phishing","tag-starkmeet","tag-unc5795"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2109"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2109\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2108"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}