Blinder Tunnel Campaign Targets Iraqi Infrastructure

Palo Alto Unit 42 has identified 'Blinder Tunnel,' a campaign by Iranian state-aligned threat actor CL-STA-1178 (with overlaps to Screening Serpens and Agent Serpens) targeting high-value infrastructure in Iraq, Israel, and the UAE. The campaign, which began staging as early as November 2025, utilizes a 'Peaky Blinders' branding theme and employs sophisticated social engineering by masquerading as Dubai Airports IT recruitment to deliver malicious coding challenges to software engineers.

The attack chain is characterized by the weaponization of legitimate .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware including ShelbyLoader V2, ShelbyC2 V2, and a modified Chisel tunneling tool named Blackwood. The actors leverage GitHub APIs and encrypted issue comments as resilient command-and-control (C2) mechanisms to blend with legitimate enterprise traffic.

This activity poses a significant risk to the aviation, telecommunications, and defense sectors in the Middle East. The use of trusted developer utilities for execution and the disabling of Event Tracing for Windows (ETW) demonstrate a high level of evasion tradecraft intended to bypass standard EDR and monitoring solutions.