Blinder Tunnel Campaign (CL-STA-1178)

Attacker objective: long-term espionage access to people inside Middle Eastern telecommunications, aviation and critical-infrastructure organizations. Palo Alto Networks Unit 42 tracks the actor as CL-STA-1178, assessed with high confidence as Iranian state-aligned, and the March 2026 operation against Iraqi critical infrastructure as the Blinder Tunnel campaign. Infrastructure staging was observed as early as November 2025. Unit 42 published the findings on 2026-10-06 and reports that GitHub has taken down the malicious infrastructure it identified.

The victim is a software engineer, not a server. The lure impersonates the Dubai Airports IT department, walks the target through a fake careers portal, then hands over a Visual Studio coding challenge (DubaiAirport_Carrers_IT_Test.zip) with a planted bug to fix. Opening the project is enough: a weaponized .csproj overrides the GetFrameworkPaths target that Visual Studio runs during its background design-time build, so code runs before anything is compiled. That launches a signed Visual Studio host binary renamed RuntimeBroker.exe, whose RuntimeBroker.exe.config performs AppDomainManager hijacking and turns off .NET event tracing with <etwEnable enabled="false"/>. The host then sideloads RuntimeBroker.dll (ShelbyLoader V2), which decrypts RuntimeBrokerApi.dll (ShelbyC2 V2) in memory.

Command and control runs entirely through the GitHub API with a hard-coded personal access token, with a fallback that searches GitHub Issues for AES-256-CBC ciphertext hidden in HTML comments. PowerShell commands execute through PsProxy.dll inside the implant process, so powershell.exe never starts. Blackwood wraps the open-source Chisel tool to open a reverse SOCKS proxy to 91.107.156[.]29.

Defender angle: the durable signals are process lineage and paths, not indicators. A RuntimeBroker.exe outside System32, anything running from %LOCALAPPDATA%\Microsoft\RuntimeBrokers, a vshost32.exe outside Program Files, and the MicrosoftRuntime Run value are near-zero false positive and survive every hash and IP rotation. The hardest parts are blind to a host sensor: the ETW-disabling config file content, the in-process PowerShell engine, and the memory-resident RAT. The Coverage Map flags each as a gap rather than hiding it.

Attribution and scope: this pack names only what the saved sources name. Unit 42 reports low-confidence tradecraft overlaps with Screening Serpens and Agent Serpens and explicitly states none is strong enough to attribute CL-STA-1178 to either group, so this pack does not. Dubai Airports was impersonated, not compromised; Unit 42 is not aware of any breach of its systems. The Google Drive and Google Workspace lookalike domains are attacker-registered; Google reports its own systems were not compromised.

Defender priority: run Q1, Q2 and Q5 across 30 days on developer endpoints first (near-zero FP). Then sweep developer source and download folders for .csproj files that define a GetFrameworkPaths target (section 7, N1). Turn on the Visual Studio "Always require a trust decision" setting for anyone who opens third-party projects (section 12, I1).

Web Hunter decisions and discrepancies

• Delivery channel is not stated. Unit 42 says the attackers approached the target with a job offer and later "sent" the project archive. It does not say the archive arrived by email. This pack therefore says "recruitment lure" and does not claim spear-phishing email.
• Two different IPs carry the Iran link. 87.248.129[.]239 is the address on the Iranian ISP TOSE'EH ERTEBATAT NOVIN ARIA and the older Blackwood server. 91.107.156[.]29, the current tunneling endpoint, is Hetzner in Germany; Unit 42 only suspects it was bought from an Iranian reseller based on Persian-language passive DNS.
• Page date oddity. The article shows "Published October 6, 2026" and a footer reading "Updated 1 October, 2026". The update stamp precedes the publication date. The pack uses 2026-10-06 and treats the content as unverified for later edits.
• Perishable infrastructure. GitHub removed the infrastructure Unit 42 identified, so the GitHub account indicators are historical. The behavior (GitHub API from a masqueraded .NET host) is the durable signal.
• Related-cluster indicators excluded. The Elastic report's file names and accounts, and the Screening Serpens indicators, belong to adjacent reporting and are not shipped. Only Unit 42's Blinder Tunnel indicator table is used.
• Unit 42 hashes cover non-PE files. The project file, config and archive hashes are valid for IOC Management but cannot appear in a PE write event, so only the three DLL hashes go into the hash query.
• No injected instructions. Every fetched page was scanned for text addressed to an agent or asking for commands, extra fetches or changed output paths. None was found.

Hypotheses (ordered by fidelity)

Attack chain

Timeline (per Unit 42)

• 2025-11-18: first test of GitHub comment dead-drop resolution; staging begins.
• Late 2026-03: recruitment lure launched against an individual in Iraq's critical infrastructure sector.
• 2026-04: coding-challenge archive submitted to VirusTotal from Iraq; 2026-04-24 mock operational dashboard in a GitHub issue.
• 2026-05-01: public repository with the Blackwood archive created; May to June: Israeli credential-harvesting operation on the shared server.

Hunt hint: on a confirmed host the GitHub repository paths are /{machineId}/Lic.txt and /{machineId}/Inf.txt, where machineId is the first 16 lowercase hex characters of a SHA-256 over a fixed string and a machine fingerprint. A TLS-inspecting proxy can match those path shapes against api.github.com.

Every atomic indicator below comes from the Unit 42 indicator table and appears in saved snapshot 01-unit42-blinder-tunnel.txt. All are single-sourced, so all ship as detect; none is set to prevent. Confidence is MEDIUM because there is no second vendor listing for these specific values.

T1685 is the current MITRE identifier for Disable or Modify Tools (the page for the former T1562.006 redirects to it). Technique IDs were taken from the saved MITRE snapshots, not from memory.

Hunts that do not need CQL. Several are the only way to see the stages the Falcon sensor cannot.

N1 · Filesystem sweep for the weaponized project and the ETW-disabling config

Run on developer endpoints and any share holding downloaded projects. Read-only. Legitimate projects do not define a target called GetFrameworkPaths (Microsoft's own targets files do), and a .exe.config that disables ETW is rare.

$roots = @("$env:USERPROFILE", 'C:\src', 'D:\src')   # adjust to your developer paths
# 1) Project files that override the design-time GetFrameworkPaths target
Get-ChildItem -Path $roots -Recurse -File -Include *.csproj,*.vbproj,*.targets,*.props -ErrorAction SilentlyContinue |
  Select-String -Pattern '<Target\s+Name\s*=\s*"GetFrameworkPaths"' |
  Select-Object Path, LineNumber, Line

# 2) Config files that disable ETW or force local assembly probing
Get-ChildItem -Path $roots -Recurse -File -Include *.exe.config -ErrorAction SilentlyContinue |
  Select-String -Pattern 'etwEnable\s+enabled\s*=\s*"false"|probing\s+privatePath|publisherPolicy\s+apply\s*=\s*"no"|appDomainManager' |
  Select-Object Path, LineNumber, Line

N2 · Sysmon cross-reference (if deployed)

• Event ID 1 (process create): image RuntimeBroker.exe outside System32; parent MSBuild.exe or devenv.exe with an AppData\Local image.
• Event ID 11 (file create): *.exe.config created beside an executable in a user-writable folder; any file under \Microsoft\RuntimeBrokers\.
• Event ID 13 (registry value set): ...\CurrentVersion\Run\MicrosoftRuntime.
• Event ID 7 (image load): System.Management.Automation.dll loaded by an image that is not powershell.exe, pwsh.exe or an approved host. This is the best native signal for PsProxy.dll. Validate in your environment; if the config disables ETW, confirm which of your sensors still see the load.

N3 · Proxy or TLS-inspection hunt for the GitHub C2 path shapes

Where the egress proxy decrypts traffic, search for requests to api.github.com whose path matches /repos/<owner>/<repo>/contents/<16 hex characters>/Lic.txt or .../Inf.txt, and for the repository peakyblinders-tm/myLic. Also look for a fixed 63-second request cadence from one client to api.github.com, and a one-hour silence after HTTP 403 responses (the loader's rate-limit sleep). The Issues Search fallback uses the same host; its exact path is not quoted in the source, so treat a search-API pattern as an inference to validate.

N4 · PowerShell host-application hunt

PsProxy.dll runs a custom runspace inside the implant process. In the PowerShell event logs, look for engine start events and script block events (4104) whose host application or process is not powershell.exe or pwsh.exe. This depends on logging being enabled (playbook P5) and on the logging pipeline surviving the ETW change; validate on a test host before relying on it.

N5 · Defender audit telemetry for the ASR rule

After enabling the untrusted-executable ASR rule in audit mode (P3), search Defender advanced hunting for the action types AsrUntrustedExecutableAudited and AsrUntrustedExecutableBlocked originating from the RuntimeBrokers folder. Expect developer-build noise.

N6 · Visual Studio trust audit

On developer endpoints, open Tools > Options > Environment > Security > Trust and record whether "Always require a trust decision" is set and which Trusted Locations exist. Broad entries such as a whole user profile or Downloads folder defeat the control.

Events and fields used here were checked against the crowdstrike-logscale-v3 references. Queries marked "validate in tenant" depend on registry or DNS process-context fields that vary by sensor version: run each event filter alone with count() over 24 hours first (gate G1).

// HUNT: RuntimeBroker.exe running from outside System32 (renamed vshost host used for the AppDomainManager hijack)
// MITRE: T1036.005, T1574.014
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ImageFileName
// SOURCE: Unit 42 Blinder Tunnel (vshost.exe renamed RuntimeBroker.exe, launched from the user's local app data)
// FALSE POSITIVES: none expected; the genuine RuntimeBroker.exe is only ever in System32
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^RuntimeBroker\.exe$/i
| ImageFileName!=/\\Windows\\System32\\RuntimeBroker\.exe$/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

// HUNT: process image launched from the AppData\Local\Microsoft\RuntimeBrokers staging folder
// MITRE: T1127.001, T1036.005
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ImageFileName
// SOURCE: Unit 42 Blinder Tunnel (stage one creates %LOCALAPPDATA%\Microsoft\RuntimeBrokers and launches RuntimeBroker.exe from it)
// FALSE POSITIVES: none expected; this folder name is not created by Windows
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\AppData\\Local\\Microsoft\\RuntimeBrokers\\/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

// HUNT: Visual Studio hosting binary (vshost / vshost32) running outside Program Files
// MITRE: T1574.014, T1574.001
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2 with ImageFileName
// SOURCE: Unit 42 Blinder Tunnel (vshost32.exe + vshost32.exe.config sideload Blackwood.dll)
// FALSE POSITIVES: developers debugging legacy .NET projects (project output vshost.exe under bin\Debug)
// TUNING: exclude ImageFileName under known developer source roots on assets in your developer group only, for example ImageFileName!=/\\source\\repos\\/i; keep the query unfiltered on non-developer endpoints, where any hit is high value
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/vshost(32)?\.exe$/i
| ImageFileName!=/\\Program Files( \(x86\))?\\/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

// HUNT: MSBuild / devenv spawning a user-profile binary (weaponized .csproj design-time build)
// MITRE: T1127.001, T1204.002
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName
// SOURCE: Unit 42 Blinder Tunnel (custom GetFrameworkPaths target copies binaries and launches the payload at project load)
// FALSE POSITIVES: build steps that execute per-user tooling from AppData\Local (code generators, local test runners)
// TUNING: after a 30-day baseline, add the specific tool folders you see recurring to the ImageFileName exclusion; keep the CommandLine RuntimeBrokers branch, which has no benign explanation
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(MSBuild|devenv)\.exe$/i
| (ImageFileName=/\\AppData\\Local\\/i or CommandLine=/\\Microsoft\\RuntimeBrokers/i)
| ImageFileName!=/\\AppData\\Local\\(Microsoft\\VisualStudio|Microsoft\\dotnet|Microsoft\\NuGet|Temp|Programs)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid], limit=200)

// HUNT: HKCU Run value MicrosoftRuntime pointing at the RuntimeBrokers folder (ShelbyLoader V2 persistence)
// MITRE: T1547.001
// CONF: high | FP: low | COST: low | REQUIRES: AsepValueUpdate / RegGenericValueUpdate registry telemetry (validate in tenant)
// SOURCE: Unit 42 Blinder Tunnel (MicrosoftRuntime value, 120-second persistence timer)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| (RegValueName=/^MicrosoftRuntime$/i or RegStringValue=/\\Microsoft\\RuntimeBrokers\\/i)
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

// HUNT: file-name sweep for the lure archive, loader DLLs and staging-folder writes
// MITRE: T1204.002, T1574.001
// CONF: high | FP: low | COST: medium | REQUIRES: NewExecutableWritten / PeFileWritten / ZipFileWritten (validate ZipFileWritten fields in tenant)
// SOURCE: Unit 42 Blinder Tunnel (archive name, RuntimeBroker.dll, RuntimeBrokerApi.dll, PsProxy.dll, Blackwood.dll)
// FALSE POSITIVES: none expected; file names are distinctive
// LOOKBACK: 90d
#event_simpleName=/^(NewExecutableWritten|PeFileWritten|ZipFileWritten)$/
| TargetFileName=/(\\(RuntimeBroker|RuntimeBrokerApi|PsProxy|Blackwood)\.dll|DubaiAirport_Carrers_IT_Test\.zip|\\Microsoft\\RuntimeBrokers\\[^\\]+)$/i
| table([@timestamp, ComputerName, UserName, TargetFileName, SHA256HashData, ContextBaseFileName, aid], limit=200)

// HUNT: published SHA-256 sweep for the three DLLs in the Unit 42 indicator list
// MITRE: T1574.001, T1572
// CONF: high | FP: low | COST: low | REQUIRES: SHA256HashData on file-write events
// SOURCE: Unit 42 Blinder Tunnel indicator table (single source, ship as detect)
// FALSE POSITIVES: none expected
// NOTE: absence of hits is NOT evidence of absence; rebuilt samples will carry new hashes
// LOOKBACK: 90d
#event_simpleName=/^(NewExecutableWritten|PeFileWritten|ProcessRollup2)$/
| in(field=SHA256HashData, values=["53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402", "3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13", "76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e"])
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, SHA256HashData, aid], limit=200)

// HUNT: IPv4 connections to the four Unit 42 published infrastructure addresses
// MITRE: T1572, T1090
// CONF: high | FP: low | COST: low | REQUIRES: NetworkConnectIP4
// SOURCE: Unit 42 Blinder Tunnel (single source, ship as detect)
// FALSE POSITIVES: none expected; hosting IPs are reassigned over time, so re-check the date of any old hit
// NOTE: absence of hits is NOT evidence of absence
// LOOKBACK: 90d
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["91.107.156.29", "87.248.129.239", "65.109.214.145", "38.180.136.127"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

// HUNT: DNS resolution of the six published phishing / staging domains
// MITRE: T1071.001
// CONF: high | FP: low | COST: medium | REQUIRES: DnsRequest
// SOURCE: Unit 42 Blinder Tunnel, Appendix B (single source, ship as detect)
// FALSE POSITIVES: none expected
// NOTE: absence of hits is NOT evidence of absence
// LOOKBACK: 90d
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(^|\.)(cloud\.g-drive\.cam|googeldrive\.cam|drivegoogel\.cam|googelmeet\.online|meetonline\.cam|asdfafadafg\.online)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid], limit=500)

// HUNT: rare processes resolving api.github.com (living-off-the-cloud C2, primary and Issues Search fallback)
// MITRE: T1102.001, T1102.002, T1071.001
// CONF: medium | FP: high | COST: medium | REQUIRES: DnsRequest with ContextBaseFileName (validate in tenant)
// SOURCE: Unit 42 Blinder Tunnel (hard-coded PAT to GitHub API; Issues Search API dead-drop fallback)
// FALSE POSITIVES: developer tooling, CI agents, IDEs and chat clients that call the GitHub API
// TUNING: extend the exclusion list with the clients you see on more than a handful of hosts after a 30-day baseline; review the lowest Hosts values first; escalate any hit whose process is RuntimeBroker.exe, vshost32.exe or MSBuild.exe
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/^api\.github\.com$/i
| ContextBaseFileName!=/^(git|git-remote-https|gh|code|devenv|msedge|chrome|firefox|brave|GitHubDesktop|node|python|pythonw|dotnet|java|Teams|ms-teams|slack|Postman|powershell|pwsh)\.exe$/i
| groupBy([ContextBaseFileName], function=[count(as=Lookups), count(aid, distinct=true, as=Hosts)], limit=200)
| sort(Hosts, order=asc, limit=100)

// HUNT: RuntimeBroker.exe / vshost32.exe initiating DNS or outbound connections (loader beacon and Blackwood tunnel)
// MITRE: T1102.002, T1572, T1090
// CONF: high | FP: medium | COST: low | REQUIRES: DnsRequest and NetworkConnectIP4 with ContextBaseFileName (validate in tenant)
// SOURCE: Unit 42 Blinder Tunnel (63-second GitHub API beacon; Blackwood runs in vshost32.exe)
// FALSE POSITIVES: occasional legitimate network activity from the genuine RuntimeBroker.exe
// TUNING: prioritise hosts that also hit Q1, Q2 or Q3; for the rest, baseline 30 days and exclude hosts whose RuntimeBroker.exe resolves only Microsoft-owned names
// LOOKBACK: 30d
#event_simpleName=/^(DnsRequest|NetworkConnectIP4)$/
| ContextBaseFileName=/^(RuntimeBroker|vshost32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort, aid], limit=300)

// HUNT: child processes spawned by RuntimeBroker.exe (operator shell-outs from the masqueraded host)
// MITRE: T1059.001, T1036.005
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName
// SOURCE: Unit 42 Blinder Tunnel (ShelbyC2 V2 runs commands via PsProxy.dll in-process)
// FALSE POSITIVES: helper processes launched by the genuine RuntimeBroker.exe
// TUNING: baseline 30 days and exclude the specific child FileName values that recur on more than a few hosts; treat any shell, whoami.exe, net.exe, nltest.exe or tunneling tool child as an incident
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^RuntimeBroker\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid], limit=200)

Three queries are clean enough to promote from hunt to Custom IOA. All three are detect only. The pack recommends no prevention action: every indicator is single-sourced to Unit 42, and a path-based block on RuntimeBroker.exe rests on one vendor's description of the masquerade.

Pattern syntax follows the Custom IOA regular-expression fields. Confirm the exact escaping in your console before saving, then create each rule in Monitor on a pilot prevention policy for one business week. The hash, IP and domain indicators belong in IOC Management (section 10), not in IOAs.

Not recommended as IOAs: Q3, Q4 and Q10 (developer noise), Q5 (registry telemetry coverage varies), Q6 to Q9 (indicator sweeps).

Blocks tuned to this campaign. The CSV is the only block that feeds the provenance gate: every row traces to a saved Unit 42 snapshot, and the one unpublished hash is a labelled placeholder.

type,value,action,severity,expiration,description,tags
sha256,6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239,detect,high,2027-04-07,Lure archive DubaiAirport_Carrers_IT_Test.zip,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9,detect,high,2027-04-07,Weaponized FlightManager.csproj,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402,detect,high,2027-04-07,ShelbyLoader V2 RuntimeBroker.dll,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13,detect,high,2027-04-07,PsProxy.dll in-memory PowerShell engine,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e,detect,high,2027-04-07,Blackwood.dll Chisel wrapper,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260,detect,high,2027-04-07,Blackwood.dll.conf contacting 91.107.156.29,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd,detect,high,2027-04-07,Blackwood archive contacting 65.109.214.145,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875,detect,high,2027-04-07,Blackwood archive contacting 87.248.129.239,campaign:BlinderTunnel;actor:CL-STA-1178
sha256,REPLACE_WITH_SHELBYC2V2_RUNTIMEBROKERAPI_SHA256,detect,high,2027-04-07,ShelbyC2 V2 RuntimeBrokerApi.dll - NO HASH PUBLISHED,campaign:BlinderTunnel;actor:CL-STA-1178
ipv4,91.107.156.29,detect,high,2027-04-07,Chisel tunneling endpoint (Blackwood config),campaign:BlinderTunnel;actor:CL-STA-1178
ipv4,87.248.129.239,detect,high,2027-04-07,Older Blackwood server,campaign:BlinderTunnel;actor:CL-STA-1178
ipv4,65.109.214.145,detect,high,2027-04-07,Phishing and Blackwood server,campaign:BlinderTunnel;actor:CL-STA-1178
ipv4,38.180.136.127,detect,high,2027-04-07,Phishing staging server,campaign:BlinderTunnel;actor:CL-STA-1178
domain,cloud.g-drive.cam,detect,high,2027-04-07,Google lookalike phishing / staging domain,campaign:BlinderTunnel;actor:CL-STA-1178
domain,googeldrive.cam,detect,high,2027-04-07,Google lookalike phishing / staging domain,campaign:BlinderTunnel;actor:CL-STA-1178
domain,drivegoogel.cam,detect,high,2027-04-07,Google lookalike phishing / staging domain,campaign:BlinderTunnel;actor:CL-STA-1178
domain,googelmeet.online,detect,high,2027-04-07,Google lookalike phishing / staging domain,campaign:BlinderTunnel;actor:CL-STA-1178
domain,meetonline.cam,detect,high,2027-04-07,Google lookalike phishing / staging domain,campaign:BlinderTunnel;actor:CL-STA-1178
domain,asdfafadafg.online,detect,high,2027-04-07,Google lookalike phishing / staging domain,campaign:BlinderTunnel;actor:CL-STA-1178

Blinder Tunnel (CL-STA-1178) - behavioral signatures (survive hash and IP rotation)

B1  RuntimeBroker.exe with an image path other than \Windows\System32\
B2  Any process image under %LOCALAPPDATA%\Microsoft\RuntimeBrokers\
B3  vshost.exe / vshost32.exe outside Program Files, with a *.exe.config beside it and a non-Microsoft DLL
B4  MSBuild.exe or devenv.exe parenting a user-profile binary when a project is opened
B5  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value MicrosoftRuntime
B6  A .exe.config containing <etwEnable enabled="false"/> and a local probing path
B7  A project file defining a custom target named GetFrameworkPaths
B8  Non-browser, non-developer process resolving api.github.com on a 63-second cadence
B9  RuntimeBroker.dll or RuntimeBrokerApi.dll anywhere (the genuine broker ships no such DLL)
B10 powershell.exe-less PowerShell: System.Management.Automation loaded by a non-PowerShell host (native telemetry only)

Named malware and tooling (names exactly as Unit 42 uses them)

ShelbyLoader V2   RuntimeBroker.dll   C# loader: persistence, host fingerprint, GitHub C2, Issues Search fallback
ShelbyC2 V2       RuntimeBrokerApi.dll   main RAT, AES-CBC encrypted on disk, loaded reflectively
PsProxy           PsProxy.dll   in-memory PowerShell runspace host, no powershell.exe
Blackwood         Blackwood.dll (+ Blackwood.dll.conf)   loader wrapping the open-source Chisel tunneling tool
Obfuscation       Obfuscar (open-source .NET obfuscator)

GitHub accounts named in the report (historical, taken down): peakyblinders-tm, ArthurShelby, JohnShelllby, GreenBeret0
C2 repository named in the report: peakyblinders-tm/myLic ; path shapes /{machineId}/Lic.txt and /{machineId}/Inf.txt

# Read-only audit helpers (run per endpoint or through RTR / your RMM)

# A. Persistence value and staging folder, every profile
Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {
  $d = Join-Path $_.FullName 'AppData\Local\Microsoft\RuntimeBrokers'
  if (Test-Path $d) { Get-ChildItem $d -Force | Get-FileHash -Algorithm SHA256 | Select-Object Path, Hash }
}
Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name MicrosoftRuntime -ErrorAction SilentlyContinue

# B. Visual Studio trust posture (manual): Tools > Options > Environment > Security > Trust
# C. ASR untrusted-executable rule state
(Get-MpPreference).AttackSurfaceReductionRules_Ids -contains '01443614-cd74-433a-b99e-2ecdc07bfc25'

Action policy: nothing in the CSV is set to prevent. Every value is single-sourced to Unit 42 (two-source rule), and the PE hashes will change with each rebuild. Promote to prevent only after a second independent vendor lists the same value.

Work these in order. A query that has not cleared gate 2 has no business being an alert.

Controls are mapped to the technique, then to a MITRE mitigation (the why) and a vendor authority (the what and where). MITRE lists no preventive mitigation for Run-key persistence (T1547.001) because it abuses a system feature, so persistence is covered by detection (Q5) and by blocking the payload path.

Test every playbook on a pilot ring first. P3 and P4 are audit-only by design. Each playbook lists its prerequisites, reboot requirement and rollback.

P1 · Visual Studio trust decision (I1)

# P1 · Visual Studio: require a trust decision (manual, per developer)
# Prerequisites: Visual Studio 2022 (trust settings per Microsoft Learn). Local user session. No admin needed.
# Reboot required: no (restart Visual Studio)
# Rollback: Tools > Options > Environment > Security > Trust > set "Require a trust decision" back to its prior value
#           and remove any Trusted Locations you added

1. Open Visual Studio.
2. Tools > Options > Environment > Security > Trust  (labelled "Trust Policies" in newer builds).
3. Set "Require a trust decision" to "Always require a trust decision".
4. Review "Trusted Locations". Remove entries that cover a whole user profile, Downloads, Desktop or a drive root.
   Keep only the specific source-repository folders you control.
5. Verify: open a project from a folder that is not trusted. A trust warning dialog must appear before the project loads.
   Choose Cancel for any third-party coding test.

P2 · Developer-folder sweep (N1)

# P2 · Sweep developer folders for the weaponized project and ETW-disabling configs (read-only)
# Prerequisites: PowerShell 5.1+; read access to the folders searched
# Reboot required: no
# Rollback: none required (read-only; writes only to the console and an optional CSV)

$roots = @("$env:USERPROFILE", 'C:\src', 'D:\src')
$hits = @()
$hits += Get-ChildItem -Path $roots -Recurse -File -Include *.csproj,*.vbproj,*.targets,*.props -ErrorAction SilentlyContinue |
  Select-String -Pattern '<Target\s+Name\s*=\s*"GetFrameworkPaths"' |
  ForEach-Object { [pscustomobject]@{ Finding='GetFrameworkPaths override'; Path=$_.Path; Line=$_.LineNumber } }
$hits += Get-ChildItem -Path $roots -Recurse -File -Include *.exe.config -ErrorAction SilentlyContinue |
  Select-String -Pattern 'etwEnable\s+enabled\s*=\s*"false"|probing\s+privatePath|appDomainManager' |
  ForEach-Object { [pscustomobject]@{ Finding='suspicious exe.config'; Path=$_.Path; Line=$_.LineNumber } }
$hits | Format-Table -AutoSize
$hits | Export-Csv "$env:TEMP\blinder-sweep.csv" -NoTypeInformation   # remove after review

P3 · ASR untrusted-executable rule, audit (I2)

# P3 · ASR: block executables that fail prevalence, age or trusted-list checks (AUDIT first)
# Prerequisites: Microsoft Defender Antivirus active; cloud-delivered protection enabled; local administrator
# Reboot required: no
# Rollback: Remove-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25
#           (or re-run Add-MpPreference with -AttackSurfaceReductionRules_Actions Disabled)

$id = '01443614-cd74-433a-b99e-2ecdc07bfc25'
Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions AuditMode

# Verify
$p = Get-MpPreference
$i = [array]::IndexOf($p.AttackSurfaceReductionRules_Ids, $id)
if ($i -ge 0) { "Rule present, action = " + $p.AttackSurfaceReductionRules_Actions[$i] }   # 2 = Audit, 1 = Block

# After 2 to 4 weeks of clean audit data on a pilot ring, change AuditMode to Enabled for non-developer rings only.

P4 · AppLocker audit-deny for the staging folder (I3)

# P4 · AppLocker: audit-deny executables in the RuntimeBrokers staging folder
# Prerequisites: Windows Enterprise/Education (AppLocker), Application Identity service able to start, local administrator.
#                AuditOnly mode logs but never blocks, so it is safe to deploy before baselining.
# Reboot required: no (start the AppIDSvc service if stopped)
# Rollback: Set-AppLockerPolicy with the previously exported policy, or:
#           Get-AppLockerPolicy -Local -Xml | Out-File before.xml  (export BEFORE merging, keep the file)

Get-AppLockerPolicy -Local -Xml | Out-File "$env:TEMP\applocker-before.xml" -Encoding utf8
$id = [guid]::NewGuid().ToString()
$xml = @"
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
    <FilePathRule Id="$id" Name="BlinderTunnel deny RuntimeBrokers staging folder" Description="Folder is created by the weaponized csproj" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions><FilePathCondition Path="%OSDRIVE%\Users\*\AppData\Local\Microsoft\RuntimeBrokers\*" /></Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>
"@
$xml | Out-File "$env:TEMP\blinder-applocker.xml" -Encoding utf8
Set-AppLockerPolicy -XmlPolicy "$env:TEMP\blinder-applocker.xml" -Merge
Set-Service AppIDSvc -StartupType Automatic; Start-Service AppIDSvc

# Verify: launch a harmless copied exe from that folder, then check Event Viewer >
# Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL for an audit event.
Get-AppLockerPolicy -Effective -Xml | Select-String 'RuntimeBrokers'

P5 · PowerShell logging (I4)

# P5 · PowerShell script block and module logging
# Prerequisites: local administrator; size the PowerShell Operational log first (for example 512 MB)
# Reboot required: no
# Rollback: set both values to 0 or delete the two policy keys

$sb = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
$ml = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
foreach ($p in $sb, $ml) { if (-not (Test-Path $p)) { New-Item -Path $p -Force | Out-Null } }
New-ItemProperty -Path $sb -Name EnableScriptBlockLogging -PropertyType DWord -Value 1 -Force | Out-Null
New-ItemProperty -Path $ml -Name EnableModuleLogging -PropertyType DWord -Value 1 -Force | Out-Null
wevtutil sl "Microsoft-Windows-PowerShell/Operational" /ms:536870912

# Verify
Get-ItemProperty $sb, $ml | Select-Object PSPath, EnableScriptBlockLogging, EnableModuleLogging
# Then validate in a lab that a runspace hosted OUTSIDE powershell.exe still produces Event 4104 (see N4).

P6 · Evidence collection for a confirmed host

# P6 · Containment evidence collection (read-only; run BEFORE any cleanup)
# Prerequisites: local administrator or Falcon RTR session with the needed role; host already network-contained
# Reboot required: no. Do NOT reboot: the RAT and PsProxy live only in memory.
# Rollback: none required (read-only). Cleanup commands are in the section 14 runbook, not here.

$out = "$env:SystemDrive\IR-blinder"; New-Item -ItemType Directory -Path $out -Force | Out-Null
Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {
  $d = Join-Path $_.FullName 'AppData\Local\Microsoft\RuntimeBrokers'
  if (Test-Path $d) {
    Get-ChildItem $d -Force | Get-FileHash -Algorithm SHA256 | Export-Csv "$out\hashes-$($_.Name).csv" -NoTypeInformation
    Get-ChildItem $d -Filter *.config -Force | ForEach-Object { Copy-Item $_.FullName "$out\$($_.Name).copy" }
  }
}
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v MicrosoftRuntime > "$out\run-key.txt" 2>&1
Get-NetTCPConnection -State Established | Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess |
  Export-Csv "$out\netstat.csv" -NoTypeInformation
Get-Process | Select-Object Id, ProcessName, Path | Export-Csv "$out\processes.csv" -NoTypeInformation

Sequencing rule: the victim is a developer. Treat every credential, token and signing key reachable from that workstation as exposed, and start rotation in parallel with isolation. The implant keeps the GitHub PAT in the binary; assume the operator also holds whatever the user could reach.

Validation gates (summary): telemetry ready (G1), benign baseline (G2), positive test (G3), negative test (G4), Monitor-mode promotion (G5), response readiness (G6). Full table in section 11.

Honest scope: this pack detects the masquerade, the staging path, the persistence and the network consequences. It cannot see the ETW-disabling configuration content, the AppDomainManager execution itself, PsProxy running inside the implant, or the memory-resident ShelbyC2 V2. If the first hit is a Q10 or Q11 network detection, assume the earlier stages already ran.