CTI · reviewed · 2026-10-07

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Full story & timeline

Actors

Iran-nexus actor (CL-STA-1178)

Malware / tools

ShelbyLoaderChisel

Campaigns

Blinder Tunnel

CVEs

—

Victim sectors

critical-infrastructureaviationtechnology

Geography

IraqUnited Arab EmiratesIsrael

MITRE ATT&CK

T1566 Phishing Initial Access
T1059 Command and Scripting Interpreter Execution
T1547 Boot or Logon Autostart Execution Persistence
T1105 Ingress Tool Transfer Command and Control
T1571 Non-Standard Port Command and Control
T1090 Proxy Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Blinder Tunnel ShelbyLoader Registry Run Persistence
id: 63ce815f-2750-4eb7-ac5f-e84039ee512d
status: experimental
description: >
    Detects creation of the HKCU Run value MicrosoftRuntime written by the
    ShelbyLoader V2 payload of the Iran-nexus Blinder Tunnel campaign
    (CL-STA-1178), which decrypts a Chisel tunneling configuration with the
    hard-coded RC4 key "My name is Blackwood !" and reverse-SOCKS proxies to
    port 10999. RuntimeBroker.dll or PsProxy.dll executed from non-standard
    paths corroborate the same intrusion.
references:
    - https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
    - https://cyber.netsecops.io/articles/iranian-blinder-tunnel-campaign-targets-iraqi-critical-infrastructure/
author: Tia N. List
date: 2026-10-07
tags:
    - attack.t1547
logsource:
    category: registry_event
detection:
    selection_run_value:
        TargetObject|endswith:
            - '\CurrentVersion\Run\MicrosoftRuntime'
    condition: selection_run_value
falsepositives:
    - No legitimate application is known to create a Run value named MicrosoftRuntime; verify the image path before acting
level: high

YARA-X raw

rule BlinderTunnel_ShelbyLoader_V2_Artifacts {
    meta:
        author = "Tia N. List"
        date = "2026-10-07"
        status = "experimental"
        description = "ShelbyLoader V2 artifacts of the Iran-nexus Blinder Tunnel campaign (CL-STA-1178): the hard-coded RC4 key used to decrypt the Chisel tunneling configuration, the Blackwood.dll.conf configuration filename, the weaponized Visual Studio recruitment-lure project file, the GitHub dead-drop resolver repositories, and the MicrosoftRuntime Run-key persistence value. Derived from case analysis (Unit 42) - NOT validated against a live sample."
        reference = "https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/"
        falsepositives = "Red-team or research tooling reusing the GitHub dead-drop names; single strings alone are weak, require at least two indicators"
    strings:
        $rc4_key = "My name is Blackwood !" ascii
        $conf = "Blackwood.dll.conf" ascii nocase
        $csproj = "FlightManager.csproj" ascii nocase
        $dead_drop_1 = "peakyblinders-tm" ascii nocase
        $dead_drop_2 = "GreenBeret0" ascii nocase
        $run_value = "CurrentVersion\\Run\\MicrosoftRuntime" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

References

Source on GitHub