Iran-linked threat actor used fake job offers to target Iraqi critical infrastructure

October 20, 2026 Palo Alto Networks 2 min read

The attackers impersonated Dubai Airports’ IT department and used trojanized coding challenges to deploy malware and maintain communications through GitHub.

Table of Contents

A fake job offer enabled an Iran-linked threat actor to use trojanized coding challenges to target high-value targets in Iraq.

The Blinder Tunnel campaign used a fake corporate identity and malicious coding exercises to deploy attack tools against targets linked to Iraq’s critical infrastructure.

Palo Alto Networks’ Unit 42 identified this activity, which it attributed with a high degree of confidence to an Iranian state-linked threat actor. The attackers impersonated the IT department of Dubai Airports and sent trojanized coding challenges to high-value targets.

A campaign prepared since 2025.

The operation targeted Iraq’s critical infrastructure in March 2026, following an infrastructure preparation phase that had been observed since November 2025. The report links attacks that other security vendors had analyzed separately and reconstructs the campaign’s evolution throughout 2026.

Related Posts:

The name Blinder Tunnel reflects the terms used by the attackers to identify components of their infrastructure and the malware’s tunneling capabilities. The campaign also incorporated references to the British series Peaky Blinders, both in the naming of its components and through the integration of the show’s theme music into the malicious software.

Techniques for deploying malware and maintaining communications.

The attack chain combined three techniques to establish an initial foothold: the use of legitimate .csproj files employed by Windows developers, AppDomainManager hijacking, and binary execution through DLL sideloading.

This sequence enabled the deployment of ShelbyLoader V2, a custom malware. To conceal their communications within legitimate cloud service traffic, the attackers abused the GitHub API as command-and-control (C2) infrastructure. Through this platform, they obtained decryption keys, downloaded payloads, and used GitHub issues as an alternative communication mechanism.

Specifically, the campaign combined code execution techniques with the use of legitimate development services to deploy malware and maintain communications with the attackers’ infrastructure.

Errors that helped link other operations.

GitHub disabled the malicious infrastructure identified as part of the campaign. The investigation also uncovered operational security and cryptographic failures that facilitated the tracking of the activity, including the exposure of tools in public repositories, the combination of phishing and tunneling infrastructure, and the inclusion of metadata in the audio file associated with the series.

These indicators made it possible to link Blinder Tunnel to another campaign attributed to the same actor. Between May and June 2026, the actor used conflict-related lures hosted on Google Drive to collect credentials from an Israeli entity. The investigation thus connected separate operations through infrastructure overlaps and mistakes made by the attackers.