Blinder Tunnel Attack: Iran Exploits GitHub and Dubai Airports to Target Critical Infrastructure

An Iranian attack disguised as a job opportunity targets critical infrastructure in Iraq

A threat group aligned with the Iranian state, identified as CL-STA-1178 by Unit 42 of Palo Alto Networks, conducted a campaign called "Blinder Tunnel" that targeted critical infrastructure in Iraq starting in March 2026. The campaign, active since November 2025, represents an evolution of operations previously associated with "The Shelby Strategy" by Elastic Security Labs. The attacks were carried out under false pretenses, posing as the IT department of Dubai airports to deliver trojanized coding challenges to high-value targets.

Quick Response

A sophisticated campaign with fake recruitment and themed malware

The Blinder Tunnel campaign stands out for its use of a theme inspired by the British TV series "Peaky Blinders," with infrastructure components named based on the show's branding and even incorporating the program's soundtrack into the malware. The attacks were carried out through a three-phase infection chain: the exploitation of legitimate Windows developer .csproj files, AppDomainManager hijacking, and the execution of binaries via DLL sideloading.

Abuse of legitimate cloud infrastructure for command and control

For command and control (C2), the attackers abused GitHub's API infrastructure, a technique known as "living off the cloud." This allowed them to blend malicious network activities with standard business traffic. GitHub repositories were used to retrieve decryption keys, download payloads, and as a backup C2 mechanism. GitHub subsequently removed the identified malicious infrastructure.

Operational errors that revealed connections to other campaigns

The investigation was facilitated by operational and cryptographic security errors made by the attackers, including the exposure of tools on public repositories, the combination of phishing and tunneling infrastructures, and the incorporation of metadata into the TV series' soundtrack. These tactical errors linked the Blinder Tunnel infrastructure to a separate campaign where the same actor exploited conflict-themed lures on Google Drive for credential harvesting against an Israeli entity between May and June 2026.

The evolution of operational capabilities since 2025

Since the launch of Blinder Tunnel in March 2026, Unit 42 researchers have identified an evolution of operational capabilities associated with the activity. The attackers used tailored social engineering tactics, exploiting recruitment lures aimed at Iraqi software developers and engineers. The attack infrastructure was staged and tested as early as November 2025, remaining dormant but operational until the campaign was activated.

Advanced evasion techniques and abuse of legitimate developer files

The infection chain introduces a new level of evasion that exploits a native .csproj file, a Microsoft developer file used to build software projects. This initial phase triggered the hijacking of AppDomainManager, followed by DLL sideloading, exploiting previously established execution techniques. AppDomainManager hijacking is an emerging evasion technique that Iranian threat groups like Screening Serpens are adopting to force trusted Windows applications to execute malicious payloads in a hidden manner.

The social engineering aspect of the campaign

At the end of March 2026, the threat group launched a social engineering campaign disguised as a professional recruitment process to compromise a specific individual, likely a software engineer. The attackers, posing as the IT department of Dubai airports, offered the target a development job. As an initial mandatory phase of the recruitment process, the attackers instructed the target to download and install a file named Dubai Airport Careers.

The strategic use of a fake career portal

The file was an Inno Setup installer that distributed a standalone offline site, disguised as a career portal. To access the assessment, the target had to log in using credentials provided by the "recruiters," simulating a realistic portal experience. After logging in, the application presented a customized 10-question HR questionnaire. Submitting the questionnaire did not trigger data exfiltration, remote communications, or malicious executions, indicating that the application was a simple diversion to build credibility and lower the target's defenses before delivering a malicious payload in the next phase of the phishing operation.

The next phase: a trojanized Visual Studio project

In April 2026, the same source that reported the career portal to VirusTotal made another report, revealing the next phase of the recruitment scam. Unlike the usual malicious links or documents seen in reports on the Iranian Dream Job campaigns, the attackers sent the target a trojanized Microsoft Visual Studio project archive, disguised as a coding assessment. The project, named DubaiAirportCarrersIT_Test.zip (with a typo in "Careers"), contained a Readme.md file with customized instructions.

Execution of the malicious payload through a coding task

The project included an intentional bug in a backend C# method: a for loop that skips the last element. The attackers instructed the target to build and run the project to find and fix the bug, a task that an experienced software engineer could perform without difficulty. The initial infection was triggered by a malicious .csproj file. Once executed, the attack chain progressed to AppDomainManager hijacking followed by DLL sideloading.

Protection and incident response

Palo Alto Networks customers are better protected from the Blinder Tunnel campaign through various products and services, including the Agentic Assistant of Cortex AgentiX, which simplified this investigation. For those who suspect they have been compromised or have urgent issues, the Unit 42 Incident Response team is available for assistance. The CL-STA-1178 activity represents a cluster of targeted cyber operations in the Middle East, previously associated with campaigns tracked by Elastic Security Labs as The Shelby Strategy.