Executive Summary
We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025. We named the campaign Blinder Tunnel after infrastructure terms the attackers used, as well as the malware’s tunneling capabilities.
While other security vendors have discussed individual attacks linked to this activity, this is the first report that not only ties together these disparate attacks as related activity, but tracks the evolving 2026 activity and the Blinder Tunnel campaign as a whole. We assess with high confidence that this activity aligns with an Iranian-nexus threat.
This campaign expands on previous operations and incorporates a “Peaky Blinders” theme by naming infrastructure components after the British crime drama’s branding — even embedding its theme song into the malware.
During our research, we discovered that the attackers established an initial foothold using a three-step attack chain:
- Exploited legitimate Windows developer .csproj files
- Performed AppDomainManager hijacking
- Executed binaries through DLL sideloading
These steps enabled the attackers to deploy custom malware that we refer to as ShelbyLoader V2. To blend in with legitimate cloud traffic, the campaign misused GitHub’s API infrastructure for command-and-control (C2) communication. It did so by leveraging repositories to:
- Fetch decryption keys
- Download payloads
- Use GitHub issues as a resilient C2 fallback mechanism
GitHub has taken down the malicious infrastructure that we identified as being associated with this campaign.
Our investigation benefited from various operational security (OpSec) and cryptographic missteps by the attackers, including:
- Exposing tools on public repositories
- Combining phishing and tunneling infrastructure
- Embedding metadata within the show’s theme song
These tactical errors linked Blinder Tunnel infrastructure to a separate campaign in which the same actor leveraged conflict-themed Google Drive lures for credential harvesting against an Israeli entity in May-June 2026.
Palo Alto Networks customers are better protected from the Blinder Tunnel campaign through the following products and services:
Cortex AgentiX Agentic Assistant streamlined this investigation.
If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.
| Related Unit 42 Topics | DLL Sideloading, Screening Serpens, Credential Harvesting |
Introduction
CL-STA-1178 represents activity from an Iranian state-aligned threat actor linked to a series of targeted cyber operations across the Middle East. Previously associated with campaigns tracked by Elastic Security Labs as The Shelby Strategy, the threat actor behind this cluster of activity frequently employs thematic branding in their malware and infrastructure, drawing inspiration from the popular television show “Peaky Blinders.”
The attackers behind this cluster target high-value infrastructure, including telecommunications, aviation and other critical entities across Iraq, Israel and the United Arab Emirates (UAE).
Since the launch of Blinder Tunnel in March 2026, Unit 42 researchers have identified an evolution in the operational capabilities associated with the activity. The attackers used tailored social engineering tactics, weaponizing recruitment lures aimed at Iraqi software developers and engineers.
We observed the threat actor staging and testing attack infrastructure as early as November 2025. This infrastructure remained dormant but operational until March 2026, when the attackers activated the campaign to target an individual in Iraq's critical infrastructure sector.
The infection chain relies on three initial execution techniques to establish covert access. The attacks introduced a new layer of evasion by weaponizing a native .csproj file, a Microsoft developer file used to build software projects. This initial stage subsequently triggered AppDomainManager hijacking, followed by DLL sideloading, leveraging their previously established execution techniques.
AppDomainManager hijacking is an emerging evasion technique that attackers are increasingly adopting, according to our recent research. Iranian threat groups like Screening Serpens and others are using this technique to force trusted Windows applications to covertly execute malicious payloads.
For C2 communication, the attackers behind Blinder Tunnel misuses legitimate GitHub API infrastructure, a strategy known as living off the cloud, to blend their malicious network activity with standard enterprise traffic. Before its removal, the GitHub repository also hosted an in-memory wrapper that executed the open-source Chisel tunneling utility. The attackers used Chisel as a bridge between their external infrastructure and compromised networks.
Figure 1 provides a high-level view of the entire campaign.
Initial Access and Delivery
Dubai Airports Careers Portal
Starting in late March 2026, the threat actor launched a social engineering campaign disguised as a professional recruitment process to compromise a specific individual, likely a software engineer. We identified this campaign through VirusTotal, following multiple file submissions from a submitter based in Iraq.
Impersonating the Dubai Airports IT department, the attackers approached a target with a job offer for a development role. Threat actors often abuse, take advantage of or subvert legitimate products for malicious purposes. This does not imply that the legitimate product is flawed or malicious. Unit 42 is not aware of any breach, compromise, or vulnerability within Dubai Airports infrastructure or systems.
As a mandatory first stage in the recruitment process, attackers instructed the target to download and install a file named Dubai Airport Careers.
This file was an Inno Setup installer that deployed a self-contained, offline site masquerading as a career portal. To access the assessment, the target had to log in using credentials provided by the “recruiters,” simulating a realistic portal experience.
Figure 2 shows the initial login screen.
After the target logged in, the application presented a tailored, 10-question HR questionnaire. Figure 2 shows part of this questionnaire.
Submitting the questionnaire does not trigger data exfiltration, remote communication or malicious execution. This lack of network or backend activity indicates that the application is a harmless decoy. This lack of suspicious activity is designed to build credibility and lower the victim's guard before delivering a malicious payload in the next phase of the phishing operation.
Recruitment Coding Challenge
In April 2026, the same source that reported the career portal to VirusTotal made another submission, revealing the next stage of the recruitment lure. Unlike the usual malicious links or documents seen in a report by ClearSky Cyber Security about Iranian Dream Job campaigns, the threat actor sent the target a weaponized Microsoft Visual Studio project archive disguised as a coding assessment.
The project, named DubaiAirport_Carrers_IT_Test.zip (misspelled Carrers instead of Careers), contained a Readme.md file with personalized instructions. The message addressed the target directly:
- “Dear <redacted full name>.”
The sender claimed to be a senior manager of a Dubai Airports IT department, instructing the recipient to open the C# Flight Management System project in their integrated development environment (IDE).
Figure 4 shows the first section of the Readme.md file, including the message tailored to the target and instructions for an at-home assessment.
Under the pretense of evaluating the target's technical abilities, the project included an intentional bug in a backend C# method: a for loop that skips the last element. Attackers instructed the target to build and run the project to find and fix the bug, a task that an experienced software engineer could accomplish without difficulty.
Three-Step Infection Chain
The initial infection is triggered by a malicious .csproj file. Once executed, the attack chain progressed to AppDomainManager hijacking followed by DLL sideloading.
Stage One: Malicious .csproj File
The attackers weaponized the C# project's .csproj configuration file by misusing Visual Studio's built-in evaluation process. This method caused the payload to execute the moment the project was loaded into the IDE, even before the developer attempted to compile the code.
Figure 5 shows the project files within the DubaiAirport_Carrers_IT_Test.zip archive, including the weaponized .csproj file.
When a developer opens a project, Visual Studio performs a design-time build in the background. This process resolves dependencies and enables various features. During this initialization phase, Visual Studio runs a specific command called GetFrameworkPaths. Building on this command, the attackers defined a custom XML target with this exact name in their malicious .csproj file, overriding the safe Microsoft default behavior.
When the target opened the project, Visual Studio attempted its routine background check and executed the attacker's custom instructions without user intervention. The script created a deceptive folder in the user's local app data: %LOCALAPPDATA%\Microsoft\RuntimeBrokers. It then copied the hidden malware binaries from the project's Resources folder to this directory and launched the payload, RuntimeBroker.exe.
Figure 6 demonstrates the exact configuration of the .csproj file, highlighting the hijacked target and the sequence that copied the malicious files to their target destination.
The malware deployed, copied itself and launched in the background while the developer was still reading the deceptive Readme.md file. This technique is classified as Trusted Developer Utilities Proxy Execution. It can be effective because the malicious background execution is triggered by the legitimate, expected behavior of msbuild.exe, a trusted developer tool.