Iranian Hackers Target Iraqi Infrastructure with Fake Recruitment Lures

An Iranian state-aligned hacker group used fake Dubai Airports recruitment lures to target Iraqi critical infrastructure in March 2026. Unit 42, CyberSecurityNews, and Intelligent CISO reported that the campaign, named Blinder Tunnel, relied on trojanized coding challenges to compromise high-value targets. Unit 42 tracks the responsible group under the identifier CL-STA-1178. [1][2][3][4]

According to Unit 42, the attackers masqueraded as the Dubai Airports information technology department. The hackers delivered malicious code disguised as technical testing materials and used GitHub for command and control infrastructure. Infrastructure staging for the operation was detected as early as November 2025. [1]

Infrastructure comprises the essential public and private facilities necessary for an economy to function. These assets include airports, water supplies, electrical grids, and telecommunications networks that provide commodities and services to sustain living conditions. [6][7]

Unit 42 named the campaign Blinder Tunnel based on specific infrastructure terminology utilized by the attackers during the operation. [1]