Unit 42 names a campaign against Iraqi infrastructure; the coverage names Iran

Palo Alto Networks' Unit 42 published research within the last 24 hours titled “Blinder Tunnel Campaign Targets Iraqi Infrastructure,” describing an intrusion set that used a bogus recruitment approach and coding test branded as Dubai Airports to compromise software engineers, delivering malware the research identifies as ShelbyLoader V2. Secondary coverage appeared the same day across several security outlets describing the same campaign and the same tooling: Calcalist’s English edition ran it as “Iranian hackers posed as Dubai Airports recruiters to breach Iraqi infrastructure”; GBHackers led on ShelbyLoader V2 without a state; CyberSecurityNews ran “Iranian Hackers Use Fake Dubai Airports Coding Test to Target Iraqi Critical Infrastructure.” For readers in the Gulf the shape of the lure is the point: a UAE state-owned aviation brand impersonated to reach targets in Iraq, with the reputational cost of the deception landing on an operator that is not party to it.

Two things are not established. The first is the attribution. The word “Iranian” is carried in downstream headlines, including by an Israeli outlet and by security-news aggregators; it is not in the vendor’s published title. Either Unit 42 makes the assessment in the body of the post with its own confidence language, or the coverage is supplying a state sponsor the researchers did not. The Files has not read the full post and does not know which, and until that is settled the campaign should be referred to by its codename rather than by a flag. The second is the victim side. Unit 42’s telemetry describing Iraqi critical-infrastructure targets is not the same as any Iraqi body confirming a compromise, and Baghdad rarely confirms. No response from Dubai Airports to the use of its brand has surfaced.

Assessment: Watch the gap between a vendor’s hedge and a headline’s certainty. Security research is written in confidence bands — assessed, likely, high confidence — and those bands are the first thing stripped out as a finding travels through aggregation. By the third retelling, a codename has a nationality. That is worth tracking independently of whether the attribution turns out to be correct, because the mechanism works the same way when it is wrong. The useful checks tomorrow are cheap: the vendor’s own confidence language and group designation, and whether any Iraqi ministry or Dubai Airports says anything at all. Silence from both is itself informative.