Blinder Tunnel Campaign Exploits GitHub APIs and Developer Files

Palo Alto Networks Unit 42 identified a cyber threat campaign named Blinder Tunnel that targets critical infrastructure in Iraq. The operation, tracked as CL-STA-1178, relies on social engineering and custom malware to compromise systems within aviation and telecommunications sectors. According to Industrial Cyber, the campaign involves sophisticated techniques designed to evade detection while maintaining persistent access to victim networks through encrypted tunnels.

Root cause

The attack originates from recruitment-themed social engineering attempts that impersonate the Dubai Airports IT department. According to Unit 42, attackers targeted individuals in Iraq’s critical infrastructure sector with fake recruitment portals. These portals featured trojanized Microsoft Visual Studio coding challenges that served as the initial delivery mechanism for malware. The deception leveraged professional aspirations to bypass initial scrutiny, leading victims to execute malicious developer project files that triggered the infection chain without requiring traditional exploitation of software vulnerabilities.

Attack path

The infection chain progresses through three distinct stages involving malicious Windows developer project files and application domain manager hijacking. Once executed, the malware employs dynamic-link library sideloading to deploy custom tools including ShelbyLoader V2 and the ShelbyC2 remote access trojan. Unit 42 noted that attackers misused GitHub APIs to disguise command-and-control communications as legitimate cloud traffic. GitHub issues provided a fallback communication mechanism if primary infrastructure failed. The Blackwood tunneling tool utilized the open-source Chisel utility to establish encrypted connections for lateral movement across compromised networks.

Affected versions

The source material does not specify particular software versions or CVE IDs associated with the vulnerability. The attack relies on social engineering and the execution of trojanized files rather than a specific software bug. According to Unit 42, the campaign targeted entities in Iraq, Israel, and the United Arab Emirates across telecommunications, aviation, and other critical infrastructure sectors. The investigation linked the Blinder Tunnel infrastructure to a separate credential-harvesting operation that targeted an Israeli entity during May and June 2026.

Mitigation

Unit 42 recommends that organizations secure developer environments and monitor for anomalous cloud-platform traffic. The researchers highlight the importance of remaining alert to recruitment-themed social engineering attempts that may originate from impersonated entities. GitHub has taken down the malicious infrastructure identified in the investigation. According to the report, defenders should focus on detecting unusual API usage patterns and validating the authenticity of job offers and coding challenges before executing associated files or connecting to external servers.

What to do and how to stay safe: Blinder Tunnel

• Verify the authenticity of recruitment communications through official channels before downloading or executing any attached files or accessing external portals.
• Monitor network logs for unusual traffic patterns involving GitHub APIs or other cloud platforms that do not align with standard development workflows.
• Implement strict controls on the execution of developer project files and validate the integrity of downloaded code before running it in production environments.
• Review access logs for signs of lateral movement or encrypted tunneling utilities that may indicate compromised systems within the network perimeter.

Step-by-step guide: Difference Between Cyber Espionage and Cyber Terrorism

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is behind the Blinder Tunnel campaign?

Unit 42 assesses with high confidence that an Iranian state-aligned threat actor conducted the campaign based on infrastructure ownership and metadata analysis.

What sectors are targeted by this campaign?

The campaign targets critical infrastructure in Iraq, Israel, and the United Arab Emirates, specifically focusing on aviation and telecommunications entities.

How do attackers maintain communication with compromised systems?

Attackers misuse GitHub APIs to disguise command-and-control traffic and use GitHub issues as a fallback mechanism if primary infrastructure becomes unavailable.