Key points
- The campaign targets critical infrastructure in Iraq using social engineering lures.
- Attackers utilise fake Dubai Airport recruitment documents to deliver malware.
- GitHub is abused as a command-and-control channel for the Blinder Tunnel toolkit.
A new threat report from Palo Alto Networks Unit 42 details the Blinder Tunnel campaign, an ongoing intrusion effort linked to Iranian state actors. The group is currently focusing on critical infrastructure sectors within Iraq, employing sophisticated social engineering tactics to bypass initial security defences.
In plain English
The attack begins with a deceptive email containing a malicious attachment disguised as a recruitment document for Dubai Airport. When a recipient opens the file, it installs the Blinder Tunnel malware on their device. This software establishes a covert connection back to the attackers, allowing them to control the compromised system remotely.
The background
Unit 42 researchers identified this campaign through first-hand analysis of the malware infrastructure and initial access vectors. The group, known as Blinder Tunnel, has previously targeted various sectors but is now specifically concentrating on Iraqi critical infrastructure. The use of fake employment opportunities from a prominent international airport serves as a highly credible lure for potential victims, increasing the likelihood of successful deployment.
What changes now
Organisations should remain vigilant against unsolicited job offers or recruitment documents, particularly those claiming affiliation with major international entities. Security teams should monitor for unusual outbound traffic to GitHub repositories, as the attackers are leveraging this platform for command-and-control communications. No specific patch has been confirmed for this social engineering vector, so user awareness and email filtering remain primary defences.
What to do and how to stay safe: Blinder Tunnel
- Phishing aims to steal data; spam aims to sell products or spread noise.
- Authentication failures often allow both, but only phishing requires human deception.
- Automated filters catch most spam but miss sophisticated phishing attempts.
Phishing aims to steal your data, while spam aims to waste your time. Verify every unsolicited request through a separate, trusted channel before taking action.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the primary lure used in the Blinder Tunnel campaign?
Attackers use fake recruitment documents purporting to be from Dubai Airport to trick victims into opening malicious files.
Which country and sector are currently being targeted?
The campaign is specifically targeting critical infrastructure sectors within Iraq.
How does the malware communicate with the attackers?
The Blinder Tunnel malware uses GitHub as a command-and-control channel to receive instructions from the threat actors.
