Unit 42 declined to name the Iranian group behind its Dubai Airports lure. The headlines named one anyway.

Palo Alto Networks' Unit 42 published its Blinder Tunnel research on Tuesday, October 6 — Calcalist’s machine-readable timestamp is 2026-10-06T11:59:22Z. Aggregation from CybersecurityNews, Cryptika, cisoai.au, offseq and the DailyDarkWeb account on X followed on October 7 and 8, much of it carrying no original date. The substance: an actor Unit 42 tracks as CL-STA-1178 masqueraded “as the Dubai Airports IT department to deliver trojanized coding challenges,” targeting Iraqi critical infrastructure in March 2026, with infrastructure staged as early as November 2025. A likely Iraq-based software engineer was approached through a fake careers portal and a harmless ten-question HR questionnaire, then sent a Visual Studio project pitched as a 15-to-20-minute coding test. Execution fired on Visual Studio’s routine background build, before any code was compiled. Command-and-control ran through GitHub repositories, with fallback instructions encrypted inside issue comments if the access token was revoked. The tunnelling tool, Blackwood, wraps the open-source Chisel utility; the tooling is branded after Peaky Blinders.

The caveat most aggregators dropped: Unit 42 assesses with high confidence that the activity is Iran-nexus, but found only low-confidence overlaps with Screening Serpens (UNC1549) and Agent Serpens (APT35 / Charming Kitten), and says explicitly that this is not enough to attribute the cluster to either. Headlines naming “Iranian hackers” are reading past the vendor’s own language. Unit 42 also says this is the first report to fold several previously documented attacks — including activity Elastic Security Labs called “The Shelby Strategy” — into one tracked cluster. The same aging problem afflicts a widely shared blackout tracker: whisper.security’s structured data gives Iran’s 2026 nationwide shutdown a start of January 8 and an end of January 27, roughly 19 days, while the FAQ on the same page still answers “Is Iran internet down right now?” with “Yes,” citing connectivity at about 2% of normal. NPR reported on May 28, 2026 that Iranians were back online after a months-long shutdown, under heavy restrictions.

Assessment: Two different decay mechanisms, one effect. Vendor research ages into folklore when aggregators strip the confidence language that was the researchers' main contribution — Unit 42 refusing to name UNC1549 or APT35 is a finding, and deleting it manufactures certainty the original authors declined to claim. The tracker fails the other way: a page whose schema and FAQ disagree will be quoted from whichever layer the reader sees first, and the human-facing one is five months stale. For any Iranian connectivity figure, go to IODA or Cloudflare Radar directly; the 2%-versus-under-1% gap between trackers suggests different baselines, not a measured change.