/
← Voltar ao feed
high critical infrastructure telecommunications aviation government

Iranian-aligned CL-STA-1178 'Blinder Tunnel' campaign hits Iraqi critical infrastructure with trojanized Dubai Airports coding lures

1 fonte(s) · 1 atualização(ões) · publicado 06/10/2026 07:00 · coletado há 1 dia

Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department and sent fake job offers with a trojanized Visual Studio coding challenge. The campaign delivered ShelbyLoader V2, ShelbyC2 V2, PsProxy.dll and Blackwood (a Chisel loader), and used the GitHub API for C2. The same actor was linked to a separate credential-harvesting campaign against an Israeli entity in May-June 2026. GitHub has taken down the identified malicious infrastructure. The actor previously appeared in Elastic Security Labs' reporting as The Shelby Strategy and uses a Peaky Blinders theme in its tooling.

Technical Details

  • Lure: a fake 'Dubai Airport Careers' Inno Setup installer served as a decoy HR portal. It was followed by DubaiAirport_Carrers_IT_Test.zip, a C# Flight Management System project with a personalized Readme.md and a deliberate bug to fix.
  • Execution chain: a malicious .csproj overrides the GetFrameworkPaths target, so the payload runs when the project is opened in Visual Studio, before any build. The chain then moves to AppDomainManager hijacking and DLL sideloading.
  • Staging: files are copied to %LOCALAPPDATA%\Microsoft\RuntimeBrokers and RuntimeBroker.exe (a renamed vshost.exe) is launched. Its RuntimeBroker.exe.config replaces the AppDomainManager and sets <etwEnable enabled="false"/> to impair ETW.
  • ShelbyLoader V2 (RuntimeBroker.dll):
    • Persists via a MicrosoftRuntime registry Run value.
    • Beacons every 63 seconds to the peakyblinders-tm/myLic GitHub repository using a hard-coded PAT, with machine fingerprint upload and tasking via Lic.txt and Inf.txt.
    • Falls back to a dead-drop resolver using the GitHub Issues Search API, with AES-256-CBC-encrypted data in HTML comments.
    • Performs anti-analysis checks (WMI, hardware, parent process explorer.exe).
  • Follow-on payloads:
    • ShelbyC2 V2 (RuntimeBrokerApi.dll) is AES-CBC encrypted and decrypted with a key derived from GitHub-hosted content.
    • PsProxy.dll runs PowerShell in-process through System.Management.Automation without spawning powershell.exe.
    • Blackwood.dll is a loader that reflectively runs a Go-compiled Chisel DLL. It opens a reverse SOCKS proxy (R:0.0.0.0:10999:socks) to 91.107.156[.]29.
  • Tradecraft: all .NET binaries are obfuscated with Obfuscar. Attribution rests on Iranian ISP-hosted infrastructure, Persian-language domains, metadata, victimology and tradecraft overlaps. Operational security errors included public tool repositories and mixed phishing and tunneling infrastructure.
  • Targets: telecommunications, aviation and other critical entities in Iraq, Israel and the UAE.
  • Unit 42 states it knows of no breach of Dubai Airports' own systems.

Remediation

  • Monitor binaries that load unknown or non-standard DLLs outside system directories.
  • Detect masquerading and abnormal process behavior around msbuild.exe and vshost-derived binaries.
  • Treat unsolicited coding challenges and project archives as untrusted, and open them only in isolated environments.
  • Monitor for GitHub API traffic from non-developer or unexpected hosts.
  • Unit 42 notes that Cortex XDR, Advanced URL Filtering and Advanced DNS Security detect or block this activity.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 06/10/2026 07:00 · coletado 19/10 17:56 primeiro registro

    Iranian-aligned CL-STA-1178 'Blinder Tunnel' campaign hits Iraqi critical infrastructure with trojanized Dubai Airports coding lures

    ler a análise desta fonte

    Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department and sent fake job offers with a trojanized Visual Studio coding challenge. The campaign delivered ShelbyLoader V2, ShelbyC2 V2, PsProxy.dll and Blackwood (a Chisel loader), and used the GitHub API for C2. The same actor was linked to a separate credential-harvesting campaign against an Israeli entity in May-June 2026. GitHub has taken down the identified malicious infrastructure. The actor previously appeared in Elastic Security Labs' reporting as The Shelby Strategy and uses a Peaky Blinders theme in its tooling.

    Technical Details

    • Lure: a fake 'Dubai Airport Careers' Inno Setup installer served as a decoy HR portal. It was followed by DubaiAirport_Carrers_IT_Test.zip, a C# Flight Management System project with a personalized Readme.md and a deliberate bug to fix.
    • Execution chain: a malicious .csproj overrides the GetFrameworkPaths target, so the payload runs when the project is opened in Visual Studio, before any build. The chain then moves to AppDomainManager hijacking and DLL sideloading.
    • Staging: files are copied to %LOCALAPPDATA%\Microsoft\RuntimeBrokers and RuntimeBroker.exe (a renamed vshost.exe) is launched. Its RuntimeBroker.exe.config replaces the AppDomainManager and sets <etwEnable enabled="false"/> to impair ETW.
    • ShelbyLoader V2 (RuntimeBroker.dll):
      • Persists via a MicrosoftRuntime registry Run value.
      • Beacons every 63 seconds to the peakyblinders-tm/myLic GitHub repository using a hard-coded PAT, with machine fingerprint upload and tasking via Lic.txt and Inf.txt.
      • Falls back to a dead-drop resolver using the GitHub Issues Search API, with AES-256-CBC-encrypted data in HTML comments.
      • Performs anti-analysis checks (WMI, hardware, parent process explorer.exe).
    • Follow-on payloads:
      • ShelbyC2 V2 (RuntimeBrokerApi.dll) is AES-CBC encrypted and decrypted with a key derived from GitHub-hosted content.
      • PsProxy.dll runs PowerShell in-process through System.Management.Automation without spawning powershell.exe.
      • Blackwood.dll is a loader that reflectively runs a Go-compiled Chisel DLL. It opens a reverse SOCKS proxy (R:0.0.0.0:10999:socks) to 91.107.156[.]29.
    • Tradecraft: all .NET binaries are obfuscated with Obfuscar. Attribution rests on Iranian ISP-hosted infrastructure, Persian-language domains, metadata, victimology and tradecraft overlaps. Operational security errors included public tool repositories and mixed phishing and tunneling infrastructure.
    • Targets: telecommunications, aviation and other critical entities in Iraq, Israel and the UAE.
    • Unit 42 states it knows of no breach of Dubai Airports' own systems.

    Remediation

    • Monitor binaries that load unknown or non-standard DLLs outside system directories.
    • Detect masquerading and abnormal process behavior around msbuild.exe and vshost-derived binaries.
    • Treat unsolicited coding challenges and project archives as untrusted, and open them only in isolated environments.
    • Monitor for GitHub API traffic from non-developer or unexpected hosts.
    • Unit 42 notes that Cortex XDR, Advanced URL Filtering and Advanced DNS Security detect or block this activity.