Palo Alto Unit 42 Links Blinder Tunnel Campaign to Iranian Actor Targeting Iraqi Critical Infrastructure

Palo Alto Networks Unit 42 has identified a cyber threat campaign named Blinder Tunnel that targets critical infrastructure in Iraq through social engineering and custom malware. The researchers attribute the activity to an Iranian state-aligned threat actor, noting targeting across aviation and telecommunications sectors in the Middle East.

The campaign, tracked internally as CL-STA-1178, saw its initial infrastructure staging and testing phases begin in November 2025 before becoming fully active in March 2026. Unit 42 assessed with high confidence that an Iranian-nexus group conducted the operation, citing forensic artifacts, embedded metadata, and specific victimology patterns that align with previous state-sponsored activities in the region.

Operational Tactics and Malware Deployment

Attackers executed a sophisticated three-stage infection chain that began with malicious Windows developer project files. According to Unit 42, the threat actors impersonated the Dubai Airports IT department to trick targets into visiting a fake recruitment portal. This portal hosted a trojanized Microsoft Visual Studio coding challenge, which served as the initial vector for delivering the malicious payloads to unsuspecting victims.

The malware deployment involved AppDomainManager hijacking and dynamic-link library sideloading to install custom tools, including the ShelbyLoader V2 loader and ShelbyC2 V2 remote access trojan. These components were deployed alongside the Blackwood tunneling tool, utilizing code obfuscation and cloud infrastructure to hide operational footprints from defensive monitoring systems.

Command-and-Control and Infrastructure Abuse

A distinctive feature of the Blinder Tunnel campaign is the misuse of GitHub’s application programming interfaces to disguise command-and-control communications as legitimate cloud traffic. Unit 42 noted that attackers used GitHub issues as a fallback mechanism to maintain connectivity if their primary infrastructure was disrupted, ensuring operational resilience during the intrusion.

The campaign also utilized the Blackwood tunneling tool, which leverages the open-source Chisel utility to create encrypted connections for lateral movement across compromised networks. Researchers linked the infrastructure used in this campaign to a separate credential-harvesting operation that targeted an Israeli entity between May and June 2026, suggesting shared resources or coordination between different operational cells.

Targeting and Geographic Scope

While the primary focus of the Blinder Tunnel campaign has been on Iraqi critical infrastructure, the targeting extends beyond a single nation or sector. Unit 42 reported that the Iranian-aligned actors have also directed their efforts toward telecommunications, aviation, and other critical entities in Israel and the United Arab Emirates. This broad geographic and sectoral scope reflects the campaign's wide-reaching nature across multiple countries in the Middle East.

GitHub has since taken down the malicious infrastructure identified in the investigation, according to Unit 42. The researchers highlighted the need for organizations to secure developer environments, monitor anomalous cloud-platform traffic, and remain alert to recruitment-themed social engineering attempts following the takedown.

What should you do?

Organizations should monitor their networks for anomalous traffic patterns, particularly those involving developer platforms and cloud services, to detect potential command-and-control communications. Security teams must also remain vigilant against recruitment-themed social engineering attempts, verifying the legitimacy of any job offers or coding challenges received via email or web portals.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: Palo Alto Networks

• Monitor network logs for unusual API calls to developer platforms like GitHub, which may indicate covert command-and-control channels disguised as legitimate traffic.
• Implement strict validation processes for all external recruitment communications, ensuring that job offers and associated links originate from verified corporate domains.
• Inspect Windows developer project files and Visual Studio configurations for unexpected modifications or embedded scripts that could indicate trojanized software.
• Review firewall rules to block unauthorized use of tunneling utilities such as Chisel, which threat actors often abuse for encrypted lateral movement.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the Blinder Tunnel campaign?

Blinder Tunnel is a cyber threat campaign attributed to an Iranian state-aligned actor, identified by Palo Alto Networks Unit 42, that uses social engineering and custom malware to target critical infrastructure.

Which countries and sectors are primarily targeted?

The campaign primarily targets critical infrastructure in Iraq, with additional focus on telecommunications, aviation, and other entities in Israel and the United Arab Emirates.

How do the attackers maintain communication with compromised systems?

Attackers misuse GitHub APIs to disguise command-and-control traffic as legitimate cloud communications and use GitHub issues as a fallback mechanism if primary infrastructure fails.