Palo Alto Networks Unit 42 publicly disclosed CL-STA-1178 on October 6, 2026, describing it as an Iranian state-aligned cluster responsible for a campaign called Blinder Tunnel. Unit 42 says this is the first report tying several previously disparate operations together into this tracked cluster. Unit 42
Intelligence field Assessment
Designation CL-STA-1178
Related public activity The Shelby Strategy
Campaign Blinder Tunnel
First infrastructure observed November 2025
Operational activity At least March 2026
Disclosure October 6, 2026
Nexus Iran
Attribution confidence High, per Unit 42
Motivation State-aligned intelligence collection / espionage
Target geography Iraq, Israel, UAE
Sectors Critical infrastructure, telecommunications, aviation and related high-value entities
Custom malware ShelbyLoader V2, ShelbyC2 V2, Blackwood
Additional tooling Chisel, PowerShell
The actor masqueraded as the Dubai Airports IT department, approaching an Iraqi target—likely a software engineer—with a fake recruitment process and weaponized coding assessment. Opening the malicious Visual Studio project could initiate execution through a .csproj file, followed by AppDomainManager hijacking and DLL sideloading. Unit 42
The resulting chain deploys ShelbyLoader V2 and ShelbyC2 V2. The actor also developed Blackwood, a custom in-memory wrapper around Chisel for tunneling into compromised networks. GitHub repositories and GitHub Issues were abused for payload retrieval, encryption-key distribution and fallback C2, allowing malicious communications to resemble legitimate cloud traffic.
Unit 42\'s Iranian attribution is based on several independent signals: Iranian-hosted infrastructure, Persian-language infrastructure relationships, metadata in an operational artifact pointing to an Iranian music service, regional victimology and convergence with Iranian espionage tradecraft. Unit 42
There are low-confidence TTP overlaps with established Iranian actors such as Screening Serpens/UNC1549 and Agent Serpens. Unit 42 explicitly says these overlaps are not sufficient to identify CL-STA-1178 as one of those groups, so I recommend retaining CL-STA-1178 as an independent actor record rather than merging it with UNC1549. Unit 42
Unit 42 — Blinder Tunnel / CL-STA-1178 full technical report and IOC set
