Blinder Tunnel Campaign Targets Iraqi Infrastructure

The Blinder Tunnel campaign, attributed to an Iranian state-aligned threat actor, targeted Iraqi critical infrastructure in March 2026 using a sophisticated social engineering lure impersonating Dubai Airports' IT department. The attack delivered trojanized Visual Studio projects that exploited .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware including ShelbyLoader V2 and Blackwood, a Chisel-based tunneling tool. Command-and-control was conducted via GitHub repositories and issues, with fallback mechanisms using encrypted comments, while infrastructure reuse linked this activity to a parallel credential-harvesting campaign targeting Israel.

AI-extracted · verify before operational use