{"id":1075,"date":"2026-10-06T11:33:46","date_gmt":"2026-10-06T10:33:46","guid":{"rendered":"https:\/\/www.intelligentciso.com\/middle-east\/2026\/10\/06\/operation-blinder-tunnel-targets-middle-east-critical-infrastructure\/"},"modified":"2026-10-06T11:33:47","modified_gmt":"2026-10-06T10:33:47","slug":"operation-blinder-tunnel-targets-middle-east-critical-infrastructure","status":"publish","type":"post","link":"https:\/\/www.intelligentciso.com\/middle-east\/2026\/10\/06\/operation-blinder-tunnel-targets-middle-east-critical-infrastructure\/","title":{"rendered":"Operation Blinder Tunnel targets Middle East critical infrastructure"},"content":{"rendered":"\n<p><em>Palo Alto Networks\u2019 threat intelligence and incident response team, Unit 42, has identified previously unreported activity attributed to an Iranian state-aligned threat actor targeting critical infrastructure in the Middle East.<\/em><\/p>\n\n\n\n<p>Palo Alto Networks\u2019 threat intelligence and incident response team, Unit 42, has identified previously unreported activity attributed to an Iranian state-aligned threat actor.<\/p>\n\n\n\n<p>Unit 42 is calling the activity \u2018Operation Blinder Tunnel\u2019 and has linked it to a separate credential-harvesting campaign targeting an Israeli entity, as well as related activity involving aviation and other critical infrastructure in the Middle East.<\/p>\n\n\n\n<p>The activity used a fake recruitment process and coding challenge to target an individual in Iraq\u2019s critical-infrastructure sector who was likely a software engineer.<\/p>\n\n\n\n<p>Unit 42 state that the attackers impersonated the Dubai Airports IT Department and sent the target a Visual Studio project disguised as a coding assessment. Simply opening the project could trigger a multi-stage malware infection, allowing the attackers to deploy a remote-access tool and establish a tunnel into the victim environment.<\/p>\n\n\n\n<p>The attackers also left behind an unusual clue: they used Peaky Blinders-themed infrastructure and embedded the show\u2019s theme song in a public GitHub repository.<\/p>\n\n\n\n<p>Metadata left in the audio file pointed to an Iranian music site and became one of several artefacts supporting Unit 42\u2019s assessment that the activity aligns with an Iranian-nexus threat actor.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Palo Alto Networks\u2019 threat intelligence and incident response team, Unit 42, has identified previously unreported activity attributed to an Iranian state-aligned threat actor targeting critical infrastructure in the Middle East. Palo Alto Networks\u2019 threat intelligence and incident response team, Unit 42, has identified previously unreported activity attributed to an Iranian state-aligned threat actor. Unit 42 [&hellip;]<\/p>\n","protected":false},"author":18,"featured_media":983,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71,484,51],"tags":[221,78,846,847,137,848,849,86,850],"class_list":["post-1075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-middle-east","category-top-stories","tag-critical-infrastructure","tag-cybersecurity","tag-iran","tag-iraq","tag-middle-east","tag-operation-blinder-tunnel","tag-palo-alto-networks","tag-threat-intelligence","tag-unit-42"],"acf":[],"publishpress_future_action":{"enabled":false,"date":"2026-10-25 23:20:49","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/comments?post=1075"}],"version-history":[{"count":0,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1075\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media\/983"}],"wp:attachment":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media?parent=1075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/categories?post=1075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/tags?post=1075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}