Operation Blinder Tunnel Targets Iraqi Critical Infrastructure

• •Operation Blinder Tunnel targets Iraqi critical infrastructure using trojanized coding challenges.
• •Attackers impersonated Dubai Airports IT to deliver malware, utilizing a Peaky Blinders theme.
• •The campaign is linked to previous credential-harvesting efforts against an Israeli entity.

Palo Alto Networks' Unit 42 has identified a campaign dubbed 'Operation Blinder Tunnel', attributed to an Iranian state-aligned threat actor targeting critical infrastructure in Iraq. The attackers impersonated the Dubai Airports IT Department to deliver trojanized coding challenges, allowing for a multi-stage malware infection. The campaign is linked to previous credential-harvesting efforts against an Israeli entity and utilized a Peaky Blinders theme, embedding the show's theme song in the malware. The attack chain involved exploiting legitimate Windows developer files, hijacking AppDomainManager, and executing binaries via DLL sideloading. The malware, referred to as ShelbyLoader V2, communicated through GitHub's API for command-and-control purposes. GitHub has since taken down the associated malicious infrastructure. This campaign highlights the evolving tactics of Iranian-aligned threat actors in the region.