Iranian-linked hackers target critical infrastructure in Israel and Iraq

A cyberespionage campaign, identified with high confidence as being linked to an Iranian threat actor, has targeted critical infrastructure and government entities in Israel and the Kurdistan Region of Iraq. The operation, referred to as ‘Blinder Tunnel,’ utilized a sophisticated three-stage attack chain involving the exploitation of development files, AppDomainManager hijacking, and DLL sideloading.

Attackers deployed custom malware named ShelbyLoader V2 and a decoy video meeting application called StarkMeet. The campaign leveraged GitHub’s API infrastructure for command-and-control communications, using the platform to fetch decryption keys and download payloads. In one confirmed instance, the attackers exfiltrated at least 1 GB of government cloud data from a Kurdistan-based environment.

The threat actors adopted motifs from the television series ‘Peaky Blinders,’ incorporating themed names and the show’s theme song into the malware code. Phishing infrastructure also mimicked diplomatic entities, including Kuwait’s Ministry of Foreign Affairs and the Gulf Cooperation Council Secretariat General, suggesting broader regional interests.