Iran-Linked Hackers Pose as Dubai Airports Recruiters in Blinder Tunnel Campaign Against Iraq

Iran-linked actors (CL-STA-1178) used fake Dubai Airports recruitment lures and a trojanized C# coding assessment that auto-executed when opened in Visual Studio via AppDomainManager hijacking and DLL sideloading; the payload deployed ShelbyLoader V2 which polls GitHub for commands, decrypts ShelbyC2 V2, and later used Blackwood (Chisel) to create reverse-proxy tunnels into an Iraqi critical-infrastructure victim’s network, with Unit 42 and Elastic linking the campaign to prior Shelby Strategy activity and advising developer-environment hardening.