CriticalPhishing
Iranian Hackers Use Fake Dubai Airports Coding Test to Target Iraqi Critical Infrastructure
Cyber Security News·Source published ·1 min read
What happened?
Iranian state-aligned hackers have used a fake Dubai Airports recruitment process to target Iraqi critical infrastructure with a booby-trapped coding test. The campaign, called Blinder Tunnel, turned a routine developer task into a quiet, potentially long-term route for remote access, persistence and network tunneling across a victim environment. The operation was prepared as early as November 2025 and activated in March 2026 against a likely Iraqi software engineer.
Key details
- Iranian-aligned hackers used a fake Dubai Airports coding test to compromise Iraqi infrastructure.
- The Blinder Tunnel campaign turned a developer coding task into a stealthy remote‑access and tunneling vector.
- Attack uses DLL sideloading with ShelbyLoader V2, persisting via a Run registry key and communicating through GitHub’s API.
- A custom Blackwood DLL provides encrypted Chisel tunnels and a reverse SOCKS proxy for deeper network movement.
Affected
- Weaponized Visual Studio project file (FlightManager.csproj).
- RuntimeBroker.dll used as the primary loader (ShelbyLoader V2).
- Registry Run key for MicrosoftRuntime used for persistence.
Fixes and mitigations
- Alert on unusual msbuild.exe activity and changes to .NET configuration files.
- Verify job‑related files via independent channels and reset any exposed credentials.
What to look for
- SHA256 hash of initial malicious archive DubaiAirport_Carrers_IT_Test.zip.
- IP address 91.107.156[.]29 used as Blackwood tunneling endpoint.
- Domain cloud.g-drive[.]cam listed as phishing domain.
- Registry Run key HKCU\...MicrosoftRuntime for ShelbyLoader V2 persistence.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.