Iran-Nexus Blinder Tunnel Campaign Hits Iraqi Infrastructure via GitHub C2

Tue, 06 Oct 2026 17:10:43 +0000

Engineer — Learn: The use of GitHub as C2 infrastructure highlights the challenge of blocking legitimate platform abuse; worth reviewing egress policies to detect anomalous GitHub API calls from non-developer workloads, but no patch or configuration change is required today.
SOC/IR — Plan: The GitHub-as-C2 pattern is a detection gap worth closing this quarter — build or tune a detection for high-volume or scripted GitHub API calls from endpoints that shouldn’t be using it; the fake recruitment lure TTP is also worth adding to phishing hunt queries.
Leader — Learn: An Iran-nexus campaign targeting regional critical infrastructure is useful geopolitical context for sector risk briefings, but absent any US/global enterprise targeting signal, no immediate leadership action is warranted.

Iran-Nexus on CuraSec