Cybersecurity experts have revealed details of a cyber espionage operation targeting Israel and the Kurdistan Region of Iraq by an Iranian-backed threat actor from August to October 2026 This article explores tunnel threat actor. . Prior to the documentation by Elastic Security Labs and Group-IB, attacks involving SHELBYLOADER (also known as HOTAIR) have been linked to the deployment of a backdoor named SHELBYC2 (formerly known as AEROSTAT), which leverages GitHub for command-and-control (C2), data exfiltration, and remote control.
In early March, Palo Alto Networks revealed a campaign referred to as Blinder Tunnel, where the threat actor, identified as CL-STA-1178, was observed impersonating the Dubai Airports IT department to distribute malware-laden coding challenges to high-value targets.
The appearance of new C2 servers in late May 2026 follows three months of inactivity, which has been characterized as the "longest downtime in nearly two decades of activity by the threat actor." "We have been tracking Prince of Persia's exfiltration activities for the past six months," Tomer Bar, the associate vice president of security research at Semperis, stated.
"The number of victims is still relatively low, which could suggest either targeted attacks or difficulties in infecting new victims." The Iranian threat actor has chosen to host its new Command & Control (C2) server on American soil, coinciding with the recent tensions between Iran and the United States.
