Analysis critical-infrastructure
CL-STA-1178 and the Blinder Tunnel Campaign: Iranian-Nexus Operators Turn a Coding Test Into a Foothold
Unit 42 attributes the Blinder Tunnel campaign to CL-STA-1178, an Iranian-nexus cluster that targeted an Iraqi critical-infrastructure engineer with a fake Dubai Airports coding test, used GitHub for command and control, and built a custom Chisel tunnelling loader.