The Coding Test Ran on Opening
Unit 42’s Blinder Tunnel report traces an Iranian-nexus operation targeting one person in Iraqi critical infrastructure. Infrastructure staging began during November 2025, recruitment in March 2026 and a fake Dubai Airports coding challenge in April. Unit 42 reported no known Dubai Airports compromise.
A malicious .csproj abused Visual Studio design-time evaluation, so loading the project could trigger AppDomainManager hijacking and DLL sideloading before an explicit build or run. Avoiding those later steps would not stop the project-load execution.
The Iranian connection is Unit 42’s high-confidence assessment, not attribution to an established named group. Its separate Israel phishing activity is not the Iraqi victim’s incident.
Inspect before loading
BlackTree recommends isolating unsolicited projects and inspecting .csproj targets before loading. Use a disposable environment without working credentials or access to production. Hunt with Unit 42’s indicators despite GitHub’s removal of the identified infrastructure.
