Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure
What Happened — An Iranian‑aligned threat group ran the “Blinder Tunnel” campaign in March 2026, delivering a custom loader (ShelbyLoader V2) to Iraqi critical‑infrastructure organizations. The attackers gained an initial foothold by abusing legitimate .csproj files, hijacking the AppDomainManager, and using DLL sideloading, then used GitHub repositories and issues for resilient command‑and‑control.
Why It Matters for Trust & Control Assurance
- The use of a public cloud developer platform (GitHub) as C2 highlights the need for continuous third‑party risk monitoring and evidence of due‑diligence on external services.
- The multi‑step exploit chain demonstrates why organizations must maintain auditable controls over software‑development pipelines and enforce strict code‑signing and integrity checks.
- Mapping this incident to the Vendor Risk Management capability helps prove that your supply‑chain oversight aligns with the NIST CSF 2.0 Identify/Protect functions.
Who Is Affected – Energy & utilities operators, government agencies, and other entities that manage critical Iraqi infrastructure; any organization that relies on external code repositories for development or deployment.
Recommended Actions
- Inventory all third‑party development platforms (e.g., GitHub, GitLab) used by your teams and map them to a continuous vendor‑risk monitoring program.
- Enforce strict code‑signing, integrity verification, and least‑privilege execution policies for build artifacts and DLLs.
- Capture and retain logs of repository access and C2‑related network traffic to provide defensible audit evidence.
Technical Notes – Attack chain: (1) abuse of legitimate .csproj files → (2) AppDomainManager hijacking → (3) DLL sideloading of ShelbyLoader V2. C2 leveraged GitHub API calls to fetch decryption keys, download payloads, and fallback to GitHub issues. Missteps by the actors (public repo exposure, phishing lures) aided attribution. Source: https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/