Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical Infrastructure

The Blinder Tunnel campaign is an ongoing operation by the Iranian state-aligned threat actor CL-STA-1178 targeting Iraqi critical infrastructure. It uses social engineering by masquerading as Dubai Airports IT department to deliver trojanized coding challenges. The attack chain exploits legitimate Windows developer files, leveraging AppDomainManager hijacking and DLL sideloading to deploy ShelbyLoader V2 malware. Command-and-control is conducted via GitHub API infrastructure, with repositories used for decryption keys and payload downloads, and GitHub issues serving as fallback communication channels. The campaign incorporates cultural references from the Peaky Blinders television show in its infrastructure and malware. Operational security failures exposed connections to a separate credential harvesting operation targeting Israeli entities using Google Drive lures themed around regional conflict during May-June 2026.

The campaign targets critical infrastructure in Iraq, potentially enabling espionage, disruption, or further compromise through the deployment of ShelbyLoader V2 malware. The use of sophisticated multi-stage techniques and abuse of legitimate infrastructure like GitHub complicates detection and mitigation. The exposure of related credential harvesting operations indicates broader regional targeting and operational scope.

No official patch or remediation is indicated for this threat. Defenders should be aware of the social engineering tactics involving trojanized coding challenges impersonating trusted entities. Monitoring for AppDomainManager hijacking and DLL sideloading techniques, as well as unusual GitHub API activity, may aid detection. Since no vendor advisory or patch information is provided, patch status is not yet confirmed—check relevant vendor advisories for updates. Incident response should focus on containment and eradication of ShelbyLoader V2 malware if detected.