Blinder Tunnel Campaign Targets Iraqi Infrastructure

This report documents the Blinder Tunnel campaign (CL-STA-1178), an Iranian state-aligned operation targeting Middle East critical infrastructure. It describes a multi-stage infection chain including weaponized Visual Studio project files, AppDomainManager hijacking and DLL sideloading, a GitHub-based C2, and the Blackwood tunneling tool, with phishing lures such as the Dubai Airports Career portal and a recurring Peaky Blinders branding. The activity demonstrates sophisticated, living-off-the-cloud techniques, extensive use of GitHub as a dead-drop resolver, and attribution linking infrastructure and tradecraft to Iranian threat groups.