Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Observations

What went wrong, and what to do about it

Real breaches, each put through the same four questions: one control that worked, one that did not, one number worth watching, and what should have been done instead. Every entry cites a primary source, because the point of this section is that you can take it to a meeting.

NO. 34/Critical infrastructure/6 October 2026

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Unit 42, 6 October 2026CVE-2026-88771CVE-2026-88772

Drafted from the advisory
Nobody here has read this one yet. The four answers below are quoted from the source document and attributed to it, so you can check every one of them against the advisory itself. Nothing in this entry was written here.

We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025. We named the campaign Blinder Tunnel after infrastructure terms the attackers used, as well as the malware’s tunneling capabilities.

What worked

Unit 42 does not name a control that held here. Read that as a finding in itself: these write-ups are built from what responders actually found, and one with no successes in it is usually describing a network that had none.

What failed

Unit 42 groups the failures under four headings: dubai airports careers portal, recruitment coding challenge, three-step infection chain, and stage one: malicious.csproj file. “Starting in late March 2026, the threat actor launched a social engineering campaign disguised as a professional recruitment process to compromise a specific individual, likely a software engineer. We identified this campaign through VirusTotal, following multiple file submissions from a submitter based in Iraq.”

The number

63 second

Beacon (63-second interval): This timer drove the primary C2 loop.

What to do instead

Cortex AgentiX Agentic Assistant streamlined this investigation by allowing the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations on what researchers should do next. Figures 16 and 17 show examples of this.

Sources

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.