# Blinder Tunnel Campaign Targets Iraqi Infrastructure

DevFeed: [Blinder Tunnel Campaign Targets Iraqi Infrastructure](<https://devfeed.tech/articles/blinder-tunnel-campaign-targets-iraqi-infrastructure-65396.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/>)

Author: Unit 42

Published: 2026-10-06T10:00:33Z

Content type: news

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [CL-CRI-1131](<https://devfeed.tech/topics/cl-cri-1131.md>), [pcpjack](<https://devfeed.tech/topics/pcpjack.md>), [Cybercrime](<https://devfeed.tech/topics/cybercrime.md>), [SockTz](<https://devfeed.tech/topics/socktz.md>), [Shadowsocks](<https://devfeed.tech/topics/shadowsocks.md>), [X (Twitter)](<https://devfeed.tech/topics/twitter.md>)

Tags: [advanced-persistent-threat](<https://devfeed.tech/tags/advanced-persistent-threat.md>), [agent-serpens](<https://devfeed.tech/tags/agent-serpens.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [appdomainmanager](<https://devfeed.tech/tags/appdomainmanager.md>), [c2](<https://devfeed.tech/tags/c2.md>), [github](<https://devfeed.tech/tags/github.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [iran](<https://devfeed.tech/tags/iran.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [unit-42](<https://devfeed.tech/tags/unit-42.md>)

## AI overview

Unit 42 reports on Blinder Tunnel, a campaign attributed with high confidence to an Iranian state-aligned threat actor. It used fake Dubai Airports recruitment lures and a weaponized Visual Studio project to target an Iraqi software engineer, then abused developer tooling and GitHub APIs to deploy malware and maintain command-and-control communications. The report details the infection chain, malware components, tunneling methods, and related targeting.

## Source excerpt

Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.