Actor Profile

CL-STA-1178 is an Iranian state-aligned threat actor tracked by Unit 42, previously associated with campaigns identified by Elastic Security Labs as "The Shelby Strategy." The actor demonstrates sophisticated operational capabilities, frequently employing thematic branding inspired by the television show "Peaky Blinders" in malware and infrastructure naming conventions. The group targets high-value infrastructure across the Middle East, with a focus on telecommunications, aviation, and other critical entities in Iraq, Israel, and the United Arab Emirates. The actor's motivation aligns with Iranian state interests in regional intelligence collection and critical infrastructure compromise. Unit 42 assesses with high confidence that this activity aligns with an Iranian nexus.

TTPs (Tactics, Techniques, Procedures)

The campaign employs a sophisticated three-stage initial access chain: exploitation of legitimate Windows .csproj developer files, AppDomainManager hijacking (an emerging evasion technique forcing trusted Windows applications to execute malicious payloads), and DLL sideloading to deploy custom malware designated ShelbyLoader V2. For C2 infrastructure, the actor implements living-off-the-cloud techniques by misusing GitHub's API infrastructure—leveraging repositories to fetch decryption keys, download payloads, and using GitHub issues as a resilient C2 fallback mechanism. The campaign deploys the open-source Chisel tunneling utility wrapped in-memory to bridge external infrastructure with compromised networks. Social engineering relies on tailored recruitment lures masquerading as the Dubai Airports IT department, delivering trojanized coding challenges to software developers and engineers. OPSEC failures included exposing tools on public repositories, combining phishing and tunneling infrastructure, and embedding metadata within theme song audio files.

Targets & Patterns

The Blinder Tunnel campaign primarily targets Iraqi critical infrastructure sectors, with specific focus on telecommunications and aviation entities. The actor employs highly tailored social engineering, weaponizing recruitment lures aimed at Iraqi software developers and engineers by impersonating the Dubai Airports IT department with fake job opportunities. Beyond Iraq, the actor maintains broader regional targeting across Israel and the United Arab Emirates, indicating a strategic focus on Middle Eastern critical infrastructure. A separate but related May-June 2026 campaign leveraged conflict-themed Google Drive lures for credential harvesting against an Israeli entity, demonstrating the actor's multi-vector approach. The targeting pattern suggests intelligence collection objectives aligned with Iranian state interests in regional critical infrastructure visibility and potential pre-positioning for disruptive operations.

Historical Context

Infrastructure staging for Blinder Tunnel was observed as early as November 2025, remaining dormant but operational until activation in March 2026. The campaign represents an evolution of activity previously tracked by Elastic Security Labs as "The Shelby Strategy," with Unit 42 being the first to tie together disparate attacks as related activity and track the evolving 2026 operations comprehensively. The actor has demonstrated consistent thematic branding across campaigns, incorporating "Peaky Blinders" references in infrastructure naming and even embedding the show's theme song into malware. A linked credential harvesting campaign targeting an Israeli entity in May-June 2026 was connected to Blinder Tunnel through OPSEC failures that exposed shared infrastructure. The actor shows operational continuity with Iranian threat groups like Screening Serpens, which also employ AppDomainManager hijacking techniques.

Defensive Recommendations

  • Monitor for AppDomainManager hijacking by detecting unexpected COMPLUS_AppDomainManagerAssembly and COMPLUS_AppDomainManagerType environment variables or registry keys associated with trusted applications
  • Implement GitHub API traffic monitoring and baseline normal developer activity to detect anomalous repository access patterns, especially automated fetching of files or use of GitHub Issues API for non-development purposes
  • Scrutinize .csproj and other developer project files for unexpected build actions or embedded malicious code, particularly when received via recruitment or external collaboration channels
  • Deploy behavioral detection for DLL sideloading by monitoring for legitimate signed binaries loading unexpected DLLs from non-standard paths, especially in user-writable directories
  • Enhance email security controls to detect recruitment-themed social engineering lures impersonating regional organizations like Dubai Airports, particularly those delivering coding challenges or technical assessments with executable components

---

# Geopolitical Context

Geopolitical Context

The Blinder Tunnel campaign represents a continuation of Iranian cyber operations targeting regional adversaries and strategically significant infrastructure across the Middle East. The operation, attributed to an Iran-aligned threat actor (tracked as CL-STA-1178), demonstrates Tehran's sustained interest in pre-positioning access within Iraqi critical infrastructure sectors—including telecommunications and aviation—likely for intelligence collection or contingency disruption capabilities. The use of Dubai Airports recruitment themes as social engineering lures reflects sophisticated targeting of technical personnel with access to sensitive systems. The campaign's timeline (infrastructure staging from November 2025, active operations in March 2026) suggests deliberate operational planning. The actor's parallel targeting of Israeli entities through separate credential harvesting campaigns during May-June 2026 indicates a broader regional operational mandate consistent with Iranian strategic priorities in Iraq, Israel, and the UAE corridor.

State Actor Alignment

Unit 42 assesses with high confidence that this activity aligns with an Iranian state nexus. The campaign is tracked as CL-STA-1178 and shares infrastructure and tactical overlaps with activity previously documented by Elastic Security Labs as "The Shelby Strategy." The targeting pattern—focused on Iraqi critical infrastructure, Israeli entities, and UAE-related lures—is consistent with Iranian intelligence collection priorities and regional strategic interests. The operational tempo, resource investment in custom tooling (ShelbyLoader V2), and focus on high-value targets suggest state-level sponsorship rather than criminal or hacktivist activity. No specific Iranian government entity or Islamic Revolutionary Guard Corps (IRGC) unit is publicly attributed in available reporting.

Business Impacty pro region

The campaign underscores Iraq's position as a contested cyber domain where Iranian-aligned actors seek persistent access to critical infrastructure, potentially complicating Baghdad's efforts to maintain strategic autonomy amid competing Iranian and Western influence. For the UAE, the misuse of Dubai Airports branding in social engineering operations may prompt heightened scrutiny of recruitment processes and third-party communications within Gulf aviation and infrastructure sectors. The parallel Israeli targeting reinforces the assessment that Iranian cyber operations maintain a multi-theater approach across the Middle East. European and allied critical infrastructure operators with regional partnerships—particularly in energy, telecommunications, and aviation—should anticipate similar recruitment-themed social engineering vectors. The campaign's reliance on Western cloud platforms (GitHub) for command and control highlights the challenge facing platform providers in distinguishing state-sponsored abuse from legitimate developer activity.

Forecast

If Iranian-aligned actors continue to refine social engineering tradecraft and cloud-based command and control techniques, defenders should expect increased difficulty in distinguishing malicious recruitment lures from legitimate professional outreach, particularly targeting technical personnel in critical sectors. If geopolitical tensions between Iran and regional actors escalate, pre-positioned access within Iraqi and Gulf infrastructure may be leveraged for disruptive operations rather than solely intelligence collection. If platform providers enhance detection of state-sponsored abuse of developer infrastructure (e.g., GitHub, cloud storage), threat actors are likely to diversify toward alternative legitimate services or self-hosted infrastructure with stronger operational security. If Iraqi critical infrastructure entities strengthen third-party vetting and endpoint detection capabilities, the operational cost for Iranian actors to maintain persistent access will likely increase, potentially shifting focus toward softer targets or less mature security environments within the region.