Unit 42 traces a fake Dubai Airports recruiter to an Iranian-nexus operation against Iraq
Palo Alto Networks describes a campaign that spent four months staging infrastructure before delivering malware inside a C# coding test. The vendor is confident about the nexus and explicitly not confident about the group.
Palo Alto Networks' Unit 42 published research on Tuesday, 6 October, describing an operation it tracks as CL-STA-1178 and names “Blinder Tunnel,” after the tunneling capability in the malware and the infrastructure terms its operators used. The campaign targeted Iraqi critical infrastructure in March 2026, with infrastructure staging observed as early as November 2025. The lure was a recruitment pipeline impersonating the IT department of Dubai Airports: an Inno Setup application called “Dubai Airport Careers” that hosted a local imitation careers site, required credentials supplied by the supposed recruiters, and presented a 10-question HR form. By Unit 42’s account the portal stole nothing and ran nothing — a deliberate choice, meant to build trust before the next stage.
The second stage arrived as an archive named DubaiAirport_Carrers_IT_Test.zip — the misspelling is the attackers' — containing a Readme.md addressed to the target by name and asking the candidate to open a C# Flight Management System project and correct a simple loop error. Opening it was sufficient. A weaponised FlightManager.csproj abused Visual Studio’s normal background evaluation process, created a RuntimeBrokers folder under local application data and launched RuntimeBroker.exe before the developer built anything. Calcalist reports the target was likely an Iraq-based software engineer, and that the same group ran a credential-harvesting campaign against an Israeli entity in May and June using war-themed lures. Unit 42 notes the operators brand their tooling after “Peaky Blinders,” with GitHub accounts named for the show’s characters and one repository embedding its theme song.
Assessment: Two things in this report will be lost in the retelling. The first is the attribution posture: Unit 42 assesses with high confidence that the activity is Iranian-nexus, and found only low-confidence overlaps with Screening Serpens (UNC1549) and Agent Serpens (APT35/Charming Kitten) — not enough to name either. Aggregators are already flattening that into “Charming Kitten hits Iraq.” It is not what the vendor wrote. The second is scope: “Iraqi critical infrastructure” in the headline resolves, in the reporting, to one software engineer. Whether that access reached an operator, and in which sector, is not established. The television branding is charming and also the cheapest false-flag surface in the report.