CL-STA-1178

Summary

Iranian state-aligned activity cluster tracked by Unit 42 as CL-STA-1178, targeting telecommunications, aviation and other critical entities in Iraq, Israel and the UAE. In its 'Blinder Tunnel' campaign it impersonated the Dubai Airports IT department and a careers portal to give an Iraqi critical-infrastructure engineer a trojanized Visual Studio coding challenge (March–April 2026), after staging infrastructure from November 2025. The chain abuses .csproj build files with MSBuild, AppDomainManager hijacking (also used to disable ETW) and DLL side-loading to run ShelbyLoader V2 and the ShelbyC2 V2 RAT, uses GitHub repositories and issue comments for keys, payloads and fallback C2, and tunnels with Chisel and 'Blackwood' configurations. Its 'Peaky Blinders' theming links it to Elastic's 2025 'Shelby Strategy' (REF8685) intrusion at an Iraqi telecom. Shared infrastructure exposed a May–June 2026 credential-harvesting campaign with conflict-themed Google Drive lures against an Israeli entity. Unit 42 assesses the Iranian nexus with high confidence, but its overlaps with named Iranian groups (Screening Serpens, Agent Serpens) are low confidence.

Attribution

Not linked to a known group

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Palo Alto Networks Unit 42 (Research, 2026-10-06)
  High confidence: Iranian-nexus

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 3

Infrastructure patterns

• GitHub API as C2: repos hold keys and payloads, issues as fallback channel (Unit 42, 2026)

Reporting and advisories 2

• Palo Alto Networks Unit 42
  Blinder Tunnel Campaign Targets Iraqi Infrastructure
• Elastic Security Labs
  The Shelby Strategy (REF8685)