Blinder Tunnel Campaign Targets Iraqi Infrastructure

Unit 42 describes the 'Blinder Tunnel' campaign (CL-STA-1178), an Iranian state-aligned operation that lured a software engineer with a trojanized Dubai Airports coding challenge to deliver a three-step infection chain (.csproj weaponization → AppDomainManager hijack → DLL sideloading), deploying ShelbyLoader V2 and ShelbyC2 V2 and a Blackwood/Chisel tunneling tool, abusing GitHub APIs and issue comments for resilient C2; the report includes technical analysis, IoCs (hashes, IPs, phishing domains, registry keys), mitigation guidance and attribution evidence linking the activity to Iran.