Conversation

Unit 42's Blinder Tunnel write-up reads like a LOL checklist.

Fake Dubai Airports dev job, a "coding challenge" Visual Studio project, and MSBuild runs the payload in the background while the target is still reading the README.

Already tracked:
MSBuild running .csproj tasks, on LOLBAS: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
Chisel for the tunnel (wrapped in-memory as "Blackwood"), on LOTTunnels: https://lottunnels.github.io/lottunnels/Binaries/chisel/

Not tracked: Microsoft's signed vshost.exe / vshost32.exe, renamed RuntimeBroker.exe, plus a .exe.config AppDomainManager hijack (with ETW turned off) to load RuntimeBroker.dll and Blackwood.dll. It is .config-based, not search order, so maybe not a HijackLibs fit, but it is worth tracking somewhere.