Blinder Tunnel Campaign Targets Iraqi Infrastructure

Blinder Tunnel is a cyber espionage campaign attributed with high confidence to an Iranian state-aligned threat actor tracked as CL-STA-1178. It targets high-value infrastructure sectors in Iraq and the broader Middle East. The attackers use a multi-stage infection chain starting with weaponized .csproj files, followed by AppDomainManager hijacking and DLL sideloading to deploy ShelbyLoader V2 malware. Command-and-control communications misuse GitHub's API and repositories, including fallback via GitHub issues, to evade detection. The campaign employs social engineering via fake Dubai Airports recruitment portals and coding challenges to gain initial access. Operational security errors by the attackers helped researchers link this campaign to other Iranian-nexus operations involving credential harvesting against Israeli targets. GitHub has removed the malicious infrastructure used in this campaign.

The campaign targets critical infrastructure entities, potentially enabling espionage, covert access, and persistent presence within victim networks. The use of advanced evasion techniques like AppDomainManager hijacking and living-off-the-cloud C2 communications increases the difficulty of detection and mitigation. The campaign's focus on high-value targets in Iraq's critical infrastructure sector and related operations against Israeli entities indicates significant geopolitical targeting. The compromise of credentials and deployment of custom malware could lead to data exfiltration, network control, or disruption of critical services.

GitHub has taken down the malicious repositories used for command-and-control in this campaign, disrupting attacker infrastructure. Palo Alto Networks customers are protected through Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR, and XSIAM products. Organizations should be aware of social engineering tactics involving fake recruitment lures and coding challenges, especially impersonating trusted entities like Dubai Airports. Monitoring for AppDomainManager hijacking and DLL sideloading techniques is recommended. Contacting incident response teams such as Unit 42 is advised if compromise is suspected. No official patch is applicable as this is a targeted campaign using social engineering and malware delivery rather than a software vulnerability.