⚠️ Region Alert: UAE/Middle East
Security researchers have identified a sophisticated cyber espionage campaign dubbed "Blinder Tunnel," attributed to the Iranian state-aligned threat actor CL-STA-1178. The operation targets critical infrastructure in Iraq, Israel, and the United Arab Emirates by impersonating the Dubai Airports IT department through fraudulent recruitment lures. The attack chain begins with trojanized Visual Studio coding challenges, utilizing a three-stage execution process that includes malicious .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy custom backdoors.
The campaign's toolset features modular malware such as ShelbyLoader V2, ShelbyC2 V2, and an in-memory Chisel tunneling wrapper named Blackwood. A key characteristic of this actor's tradecraft is the misuse of legitimate GitHub API infrastructure for command-and-control (C2) communications, including the use of GitHub Issues as a resilient fallback mechanism. The actor consistently employs a "Peaky Blinders" pop-culture theme throughout its infrastructure, which ultimately aided analysts in attribution through operational security failures and embedded metadata.
Top comments (0)