malware Archives | Security Sense

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Posted on October 6, 2026 by Kyle

Overview

The Blinder Tunnel campaign is an Iran-nexus advanced persistent threat (APT) operation primarily targeting critical infrastructure entities within Iraq. This campaign utilizes social engineering tactics, specifically fake recruitment lures, to gain initial access and deploy custom malware that leverages GitHub for command and control (C2). The focus on critical infrastructure highlights the potential for significant operational disruption.

Technical Analysis

Based on the limited public information, the Blinder Tunnel campaign operates as follows:
* Initial Access: Attackers employ spearphishing, using fake recruitment lures purportedly from ‘Dubai Airports’ to entice targets. These lures likely contain malicious attachments or links designed to execute the initial payload.
* Payload Delivery: The specific initial payload mechanism is not detailed, but it leads to the deployment of custom malware.
* Command and Control (C2): The deployed malware utilizes GitHub as its C2 channel. This method can help blend C2 traffic with legitimate network activity, making detection more challenging.
* Targeting: The primary targets are critical infrastructure organizations in Iraq.
Specific malware capabilities, persistence mechanisms, and post-exploitation activities are not publicly detailed at this time.

Detection

Defenders should focus on identifying anomalous activity related to initial access and C2 communications:
* Email Gateway Logs: Monitor for emails with suspicious sender domains, subject lines related to ‘Dubai Airports’ recruitment, or unusual attachment types (e.g., .zip, .iso, .img, .docm).
* Endpoint Detection and Response (EDR) Logs: Look for processes spawned by email clients or document readers that execute unusual commands (e.g., powershell.exe, cmd.exe, script interpreters) or make outbound network connections to non-standard ports or suspicious domains.
* Network Proxy/Firewall Logs: Monitor for outbound connections to github.com or raw.githubusercontent.com from systems not typically involved in software development or IT operations. Look for unusual data transfer volumes or patterns.
* DNS Logs: Identify frequent or unusual DNS queries for GitHub-related domains from non-developer workstations.
* Behavioral Analysis: Hunt for processes attempting to download or execute content directly from GitHub URLs using tools like curl.exe, wget.exe, or Invoke-WebRequest.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Process Creation from Email or Document Application

title: Suspicious Process Creation from Email or Document Application
id: d7e0f1b2-c3d4-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects suspicious processes spawned by common email clients or document viewers, indicative of initial access via malicious attachments or links.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\word.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\acrord32.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection
level: high

Outbound Connection to GitHub from Suspicious Process

title: Outbound Connection to GitHub from Suspicious Process
id: e8f9a0b1-c2d3-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects network connections to GitHub domains from processes not typically associated with web browsing or development, potentially indicating GitHub-based C2.
logsource:
  product: windows
  service: sysmon
  definition: 'The Sysmon event ID 3 (Network connection) should be enabled.'
detection:
  selection_github_domains:
    DestinationHostname|contains:
      - 'github.com'
      - 'raw.githubusercontent.com'
  filter_legitimate_processes:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\git.exe'
      - '\code.exe' # VS Code
  condition: selection_github_domains and not filter_legitimate_processes
level: medium

Mitigations

User Awareness Training: Educate employees, especially those in critical roles, about spearphishing tactics, fake recruitment lures, and the risks of opening unsolicited attachments or clicking suspicious links.
Email Security Gateway: Implement and configure robust email security solutions to filter malicious emails, identify spoofed sender domains, and scan attachments for known threats.
Endpoint Protection: Deploy EDR solutions capable of detecting and blocking malicious process execution, suspicious child processes, and unusual network connections.
Network Segmentation and Monitoring: Segment critical infrastructure networks to limit lateral movement. Monitor outbound network traffic for connections to known malicious C2 infrastructure and suspicious legitimate services like GitHub from non-standard hosts.
Application Whitelisting: Restrict the execution of unauthorized applications and scripts to prevent the initial payload from running or the C2 malware from executing.

References

https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1566.001 — Spearphishing Attachment
T1102.001 — Dead Drop Resolver

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,547 input / 1,476 output tokens ·

  Reviewed and approved by a human analyst before publication

ClickFix Attacks Evolve to Leverage DNS TXT Records and Browser Pre-fetching for Payload Hiding

Posted on October 6, 2026 by Kyle

Overview

ClickFix attacks have adopted new evasion techniques, specifically leveraging DNS TXT records for payload storage and browser cache pre-fetching for staging. This evolution aims to obscure the initial stages of the attack chain, making it harder for security tools to identify and block malicious activity before execution. The techniques allow threat actors to bypass traditional network filtering and detection mechanisms focused on common payload delivery protocols.

Technical Analysis

Threat actors are enhancing ClickFix attacks by employing two primary methods to hide and stage malicious payloads:

Payload Hiding via DNS TXT Records: Malicious code, URLs, or command-and-control (C2) instructions are embedded within DNS TXT records. When a victim’s system resolves a specific domain, it retrieves the TXT record, which then contains the hidden payload or a pointer to it. This method allows for data exfiltration or ingress tool transfer over DNS, bypassing network defenses that might not inspect DNS query content beyond basic resolution.
Browser Cache Pre-fetching: Once the malicious content is retrieved (e.g., from a TXT record or a linked resource), it is then staged using legitimate browser pre-fetching mechanisms. This allows the payload to be downloaded and stored in the browser’s cache without direct user interaction or overt network activity that might trigger alerts. This pre-staging sets the groundwork for later execution, making the attack appear less suspicious at the point of initial download.

Detection

Defenders can focus on identifying the underlying mechanisms used for evasion:

Monitor DNS queries for unusual patterns, specifically requests for TXT records from domains not typically associated with legitimate TXT record usage (e.g., SPF, DKIM). Look for TXT records containing unusually long strings or base64-encoded data.
Analyze network traffic for large or unusual data transfers via DNS, which could indicate payload exfiltration or delivery through TXT records.
Inspect endpoint logs (e.g., Sysmon Event ID 22 for DNS queries) for suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making TXT record queries to external domains.
Monitor process creation events (e.g., Sysmon Event ID 1) for suspicious executables being launched by web browsers (chrome.exe, firefox.exe, msedge.exe) or their child processes, which could indicate the execution of a pre-fetched payload.

Sigma Detection Rules

Suspicious Process Querying DNS TXT Record

title: Suspicious Process Querying DNS TXT Record
id: 9382b1c4-d5e7-4f1a-b8c3-f0a9e1e2f3g4
status: experimental
description: Detects suspicious processes making DNS TXT record queries, which can indicate payload retrieval or C2 activity via DNS.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 22
    QueryType: 'TXT'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection
level: high

Suspicious Process Creation by Web Browser

title: Suspicious Process Creation by Web Browser
id: 8a7b6c5d-4e3f-2a1b-0c9d-8e7f6a5b4c3d
status: experimental
description: Detects suspicious processes spawned by common web browsers, potentially indicating execution of a pre-fetched or downloaded malicious payload.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\msiexec.exe'
  condition: selection
level: high

Mitigations

Enhanced DNS Monitoring and Filtering: Implement advanced DNS security solutions capable of inspecting DNS query content, including TXT records, for anomalies, embedded malicious data, or known malicious domains. Consider blocking TXT queries to non-standard or untrusted domains for non-DNS-related services.
Network Traffic Analysis: Deploy network intrusion detection/prevention systems (NIDS/NIPS) with deep packet inspection to identify unusual protocols or data patterns over standard ports, especially DNS. Look for DNS traffic that deviates significantly from normal behavior in terms of size or frequency.
Endpoint Security Configuration: Configure web browsers and endpoint security solutions to restrict or log pre-fetching activities, particularly from untrusted domains. Implement application control to prevent suspicious executables from launching from browser-related directories or temporary folders.
User Awareness Training: Educate users about the risks of clicking suspicious links and the importance of verifying sources, as initial compromise might still leverage social engineering to direct users to malicious sites.

References

https://www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloads

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1071.004 — DNS
T1027 — Obfuscated Files or Information
T1105 — Ingress Tool Transfer
T1562 — Impair Defenses

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,482 input / 1,508 output tokens ·

  Reviewed and approved by a human analyst before publication

NeedyMantis: Modular Post-Compromise Malware Framework

Posted on September 28, 2026 by Kyle

Overview

NeedyMantis is a modular post-compromise malware framework used in targeted intrusions. It leverages custom loaders, encrypted archives, and extensible components to establish and maintain long-term access, enabling subsequent malicious operations. Microsoft Threat Intelligence identified this framework in use against specific targets.

Technical Analysis

NeedyMantis operates as a modular framework, allowing threat actors to deploy various components as needed.
It utilizes custom loaders, suggesting a tailored approach to initial execution and evasion.
The framework employs encrypted archives, likely for storing its components, exfiltrating data, or obscuring malicious payloads.
Designed for extensibility, indicating a capability for threat actors to adapt and expand its functionalities post-compromise.
The primary objective is to maintain long-term access within compromised environments and support follow-on activities.

Detection

Monitor for suspicious process creation chains, particularly legitimate processes (e.g., svchost.exe, explorer.exe) spawning unusual executables in non-standard paths.
Look for the creation or modification of encrypted archive files (e.g., .zip, .rar, .7z) in unexpected directories, especially by processes not typically associated with archiving.
Analyze network traffic for unusual outbound connections to unknown or suspicious IP addresses and domains, indicative of command-and-control (C2) communication.
Hunt for registry modifications or scheduled tasks establishing persistence, especially those pointing to newly created or modified executables.
Monitor for unusual file system activity, such as the creation of hidden files or directories, or modifications to system binaries.

Sigma Detection Rules

Suspicious Process Spawning from Legitimate Parent

title: Suspicious Process Spawning from Legitimate Parent
id: 9c1d2e3f-4a5b-6c7d-8e9f-0123456789ab
status: experimental
description: Detects suspicious process creation where a common legitimate Windows process spawns an unusual executable in a non-standard path, indicative of a custom loader or malware execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\svchost.exe'
      - '\\explorer.exe'
      - '\\lsass.exe'
    Image|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
    Image|endswith:
      - '.exe'
      - '.dll'
    CommandLine|contains:
      - ' -load'
      - ' -exec'
  condition: selection
level: high

Creation of Encrypted Archive in Suspicious Location

title: Creation of Encrypted Archive in Suspicious Location
id: a1b2c3d4-e5f6-7a8b-9c0d-1234567890ef
status: experimental
description: Detects the creation of common encrypted archive file types in user profile or system temporary directories, which could indicate data staging for exfiltration or malware component storage.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11 # FileCreate
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.gz'
      - '.tar.gz'
    TargetFilename|contains:
      - 'C:\Users\'
      - 'C:\Windows\Temp\'
      - 'C:\ProgramData\'
  condition: selection
level: medium

Registry Persistence via Run Key for Suspicious Path

title: Registry Persistence via Run Key for Suspicious Path
id: b2c3d4e5-f6a7-8b9c-0d1e-2345678901fg
status: experimental
description: Identifies modifications to common Windows Run registry keys that point to executables in non-standard or temporary directories, a common persistence mechanism for malware like NeedyMantis.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 13 # RegistryEvent (Value Set)
    TargetObject|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Run\'
      - 'Software\Microsoft\Windows\CurrentVersion\RunOnce\'
    Details|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
      - '.exe'
      - '.dll'
  condition: selection
level: high

Mitigations

Implement robust Endpoint Detection and Response (EDR) solutions to detect and respond to post-compromise activities, including suspicious process execution and file modifications.
Enforce application whitelisting or strong application control policies to prevent the execution of unauthorized or unknown executables and scripts, including custom loaders.
Regularly patch and update all operating systems, applications, and network devices to remediate known vulnerabilities that could be exploited for initial access.
Implement network segmentation and egress filtering to limit lateral movement and restrict outbound connections to only necessary and approved destinations.
Conduct regular security audits and penetration testing to identify and address weaknesses in your environment before they can be exploited.

References

https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1055 — Process Injection
T1071.001 — Web Protocols
T1560.001 — Archive via Utility
T1105 — Ingress Tool Transfer
T1547.001 — Registry Run Keys / Startup Folder
T1090 — Proxy

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,611 input / 1,597 output tokens ·

  Reviewed and approved by a human analyst before publication