Iranian APT - Blinder Tunnel: Blackwood - Chisel Reverse SOCKS Tunnel Egress

Awais Munir@iawais

•updated 9 days ago•1•1•8

Detects the Blackwood tunneling tool from Blinder Tunnel. Blackwood.dll is sideloaded into a signed vshost32.exe via its .config and reflectively loads Go-compiled Chisel, which dials a raw public IP and opens a reverse SOCKS proxy for lateral pivoting.