Iranian APT - Blinder Tunnel: GitHub API - Cloudflare Workers Relay C2 from a Lookalike Binary
Detects the Blinder Tunnel C2 loop. The loader beacons about every 63 seconds to the GitHub Contents API (profile upload, one-time license read). The newer variant can instead go through a Cloudflare Workers relay that mirrors the GitHub API paths. Both platforms are legitimate, so the signal is the client: the implant install directory, a non-System32 RuntimeBroker.exe, or any binary under AppData\Local\Microsoft\, none of which are real GitHub clients. Known implant hosts and the known relay alert on a single hit. The lookalike-path arm needs 10 or more connections per hour (a 63-second loop produces 100+), which suppresses incidental noise. Depends on RemoteUrl being populated for TLS connections.
Microsoft Sentinel (KQL)
