Analysis communicationstransport
CL-STA-1178 and the Blinder Tunnel Campaign: Iranian-Nexus Operators Turn a Coding Test Into a Foothold
Unit 42 attributes the Blinder Tunnel campaign to CL-STA-1178, an Iranian-nexus cluster that lured an Iraqi infrastructure developer with a fake Dubai Airports coding test, ran its implants through GitHub, and tunnelled out with a custom Chisel loader.