Dust Specter: Iran's Ghost in the Iraqi Ministry

When Zscaler ThreatLabz researchers published their technical analysis on March 2, 2026, they introduced the security community to a threat actor they had been tracking internally as Dust Specter. The name is new. The playbook is not. What makes this campaign worth paying close attention to — beyond the four fresh malware families — is what it reveals about how Iranian APT operations have quietly evolved: they are now leaning on generative AI to write their malicious code faster, they are using their victims' own government infrastructure against them, and they have been doing all of this against the same targets, in the same country, for years.

Iraq's Ministry of Foreign Affairs has been a recurring target for Iranian state-linked hackers since at least March 2024, when Check Point identified the first samples of APT34's Veaty and Spearal backdoors targeting Iraqi government infrastructure. Dust Specter is the latest chapter in that story — but understanding it fully requires reading the earlier ones too.

Who Is Dust Specter?

ThreatLabz attributes this campaign to an Iran-nexus threat actor with medium-to-high confidence, based on overlapping tools, targeting patterns, and operational techniques consistent with known Iranian APT groups — most notably APT34, also tracked as OilRig, Hazel Sandstorm, Earth Simnavaz, and Helix Kitten. The group is believed to operate under Iran's Ministry of Intelligence and Security (MOIS).

Zscaler has not yet made a definitive public link between Dust Specter and APT34 specifically, and this distinction matters. ThreatLabz has stated it will update attribution as higher-confidence indicators emerge. But the circumstantial case is compelling. The use of lightweight, custom .NET backdoors with no code obfuscation is a recognized signature of several Iran-linked APT groups. The operational pattern of compromising Iraqi government infrastructure to host payloads — rather than relying on external servers — is something APT34 did against the same Iraqi Ministry of Foreign Affairs as recently as 2024.

"The goal is likely espionage, because those countries are at least, to some degree, allies of Iran, so I don't think, in this case, the main goal is destruction." — Sergey Shykevich, Threat Intelligence Group Manager, Check Point Research (on APT34's Iraq operations, Dark Reading, April 2025)

Check Point Research's analysis of APT34's 2024 campaign against Iraqi government ministries is particularly relevant context here. That campaign used two new malware families — Veaty and Spearal — alongside a compromised Iraqi government website to deploy payloads and maintain persistence. The installer even bore the logo of the Iraqi General Secretariat of the Council of Ministers. The parallels with Dust Specter's 2026 campaign are difficult to ignore: same target ministry, same tactic of weaponizing Iraqi government domains, same lightweight .NET tooling philosophy.

Four New Tools, Two Attack Chains

What sets the January 2026 campaign apart technically is the introduction of four completely undocumented malware families. ThreatLabz identified two distinct attack chains operating in parallel — suggesting Dust Specter either ran parallel operations against different target segments, or is actively iterating on its tooling between engagements.

Attack Chain 1: SPLITDROP, TWINTASK, and TWINTALK

The first chain begins with a password-protected RAR archive named mofa-Network-code.rar — the "mofa" prefix referencing Iraq's Ministry of Foreign Affairs. The archive contains a 32-bit .NET binary disguised as a WinRAR application. This is SPLITDROP.

SPLITDROP presents the victim with a dialog box asking for a password to extract a file — a piece of social engineering baked directly into the dropper itself. If the victim supplies the correct password (which would have been provided as part of the original lure), SPLITDROP uses it to decrypt an embedded AES-256 CBC encrypted resource using a PBKDF2 key derivation function. It then checks for the presence of C:\ProgramData\PolGuid.zip as an anti-reinfection measure — if the file already exists, execution halts.

Once the decryption succeeds, SPLITDROP deploys two DLL files: TWINTASK and TWINTALK. Both are launched via DLL sideloading — TWINTASK is disguised as libvlc.dll and hijacks the legitimate VLC media player binary, while TWINTALK masquerades as hostfxr.dll and sideloads through WingetUI. Both techniques exploit trusted, signed applications to launch malicious code without triggering standard detection.

TWINTASK functions as the worker module and TWINTALK as the C2 orchestrator. The two components communicate through a file-based polling mechanism using in.txt and out.txt files written to disk — an unusually simple inter-process communication method that may have been chosen for its low detection profile. TWINTASK executes received commands and writes results back to the polling files. TWINTALK handles all external communication over HTTPS, mimicking Chrome browser traffic via a hardcoded User-Agent string.

Persistence is established through a Windows Registry Run key pointing to the malicious VLC binary, stored as HKCU\Software\Microsoft\Windows\CurrentVersion\Run\VLC.

# MITRE ATT&CK mapping: Attack Chain 1
T1574.002  DLL Side-Loading (TWINTASK via libvlc.dll, TWINTALK via hostfxr.dll)
T1112      Modify Registry (Run key persistence)
T1140      Deobfuscate/Decode Files (AES-256 CBC with PBKDF2)
T1071.001  C2 via HTTPS
T1001.003  Data Obfuscation: Protocol or Service Impersonation (Chrome User-Agent mimicry)
T1132.001  Base64 encoding with random prepended character

Attack Chain 2: GHOSTFORM

GHOSTFORM is the more evolved tool. It consolidates the entire first-chain architecture into a single .NET binary — removing the need for a separate dropper, two DLLs, and a file-based polling mechanism. The second chain's delivery archive is named mofaSurvey_20_30_oct.zip, again referencing the Ministry of Foreign Affairs.

GHOSTFORM's standout evasion technique is one of the more creative approaches seen in recent .NET malware: rather than using standard Windows wait APIs to introduce a beaconing delay, it creates an almost completely transparent Windows form — just 10 by 15 pixels, with opacity set near zero and hidden from the taskbar — and uses a timer on that invisible form to stall execution before returning to its main loop. From a defender's perspective, there is a process running a GUI application with no visible window.

The social engineering layer built into GHOSTFORM is equally notable. Some samples contain a hardcoded Google Forms URL that opens a fake Arabic-language survey impersonating an official Ministry of Foreign Affairs questionnaire for government employees. The victim fills out what appears to be a legitimate administrative form while GHOSTFORM operates in the background.

GHOSTFORM also uses in-memory PowerShell script execution for command handling, meaning commands received from the C2 server are executed without touching the filesystem — significantly reducing its forensic footprint compared to the first attack chain. Additionally, ThreatLabz identified the use of emojis and unicode text within the decompiled TWINTALK and GHOSTFORM codebases, which researchers flagged as indicators of AI-assisted development.

The C2 Infrastructure: Built to Resist Analysis

Dust Specter's command-and-control setup reflects a deliberate effort to make its traffic blend in and its servers resistant to passive scanning. The C2 servers use randomized URI paths with checksum values appended — ensuring that any request without a valid checksum is rejected outright. This means security researchers or automated scanners probing the C2 infrastructure from outside an infected host receive no response, making the infrastructure harder to characterize.

The servers also enforce geofencing and User-Agent verification. Requests arriving from unexpected geographic locations or using non-Chrome User-Agent strings are silently ignored. This combination of checksum validation, geofencing, and User-Agent filtering creates a three-layer authentication mechanism before the server will acknowledge any incoming connection.

Bot identification is handled by encoding the bot ID and version inside the iat field of a JWT token within HTTP request headers — an unusual choice that buries tracking data inside a field ordinarily used for token issuance timestamps. GHOSTFORM derives its bot ID from the assembly creation time rather than generating a random value, and uses non-zero bot version strings with apparently random formatting.

Perhaps most significantly: one of the TWINTALK C2 domains was also used by Dust Specter in July 2025 to host a page mimicking a Cisco Webex for Government meeting invitation — a ClickFix-style delivery mechanism that prompted victims to copy and paste a PowerShell command. That PowerShell command sent a GET request to meetingapp[.]site/webexdownload to retrieve the malicious payload. This infrastructure overlap is what connects Dust Specter's 2026 Iraq campaign to operations that were already running at least six months earlier.

The AI Angle: When the Malware Writes Itself

The generative AI component of this campaign deserves its own analysis rather than being treated as a footnote. ThreatLabz researchers found multiple code fingerprints indicating that Dust Specter used AI tools to assist in developing at least two of the four malware families. The specific indicators — including emoji usage and unicode formatting patterns in decompiled code — are consistent with outputs from large language model-based code generators.

This is not an isolated trend. Google's Threat Intelligence Group and other AI vendors have published reports indicating that Iranian APT groups began integrating generative AI into their development workflows during 2024 and 2025. What we are seeing with Dust Specter is the operational output of that integration: novel malware with unconventional code patterns, developed faster than traditional hand-coding methods allow, and structured in ways that may evade detection logic trained on human-written malicious code.

"Generative AI has been quickly adapted by several threat actors and recent reports from AI vendors indicate that Iran-linked APT groups have integrated AI in their attack lifecycle." — Zscaler ThreatLabz, Dust Specter report, March 2026

The practical implication for defenders is significant: detection approaches that rely on recognizing known code patterns, structural signatures, or stylistic fingerprints of human-written malware will become progressively less reliable as AI-assisted development matures. The invisible Windows form technique used by GHOSTFORM is a good example — it is technically simple but conceptually unusual, and may have originated from an AI-generated suggestion rather than a human developer's established toolkit.

Iraq as a Permanent Target

To understand why Dust Specter targeted Iraq's Ministry of Foreign Affairs specifically, it helps to zoom out. Iranian state-linked cyber actors have had a consistent strategic interest in monitoring Iraqi government communications since at least 2014, when APT34 was first documented conducting operations in the region. Iraq occupies a peculiar position in Iranian foreign policy — it is simultaneously a neighbor, a partial ally, a major trade partner, an active US military presence, and a country with significant Shia political factions that Tehran works to influence.

The Ministry of Foreign Affairs is the ideal target for any state actor interested in tracking Iraqi diplomatic positioning: who Iraq is meeting with, what agreements are being discussed, and how Baghdad navigates its relationships with Washington, Tehran, and Riyadh simultaneously.

"In Iraq, these threat actors are most probably trying to counter the influence of Western governments following the US invasion and occupation of the country." — ESET researchers, as reported by The Record, June 2025

The 2024 APT34 campaign uncovered by Check Point hit the same ministry using malware that bore the Council of Ministers' official logo — meaning the targeting was precise and the lures were tailored for Ministry employees specifically. Dust Specter's 2026 campaign uses archive file names and a fake Arabic-language Google Forms survey that are equally specific to Ministry staff. These are not generic phishing campaigns. They are precision intelligence collection operations against a specific institutional target that Iranian state actors have been working to penetrate for years.

The consistent failure to fully expel these actors — despite public exposure — is itself a pattern worth noting. Check Point's researchers observed in early 2025 that APT34 campaigns against Iraq had continued even after public disclosure, because the affected organizations often began incident response procedures without completing them. As Amitai Ben Shushan Ehrlich, threat intelligence team leader at Check Point, put it: "it's very common that an organization is aware of an intrusion, starts some sort of response procedure, and doesn't finish it properly, to the point where the same threat actor can still return."

Key Takeaways

1. Dust Specter is likely not new — just newly named: The infrastructure overlap with July 2025 operations and the strong TTP alignment with APT34's known Iraq campaigns suggest this group has been active for at least a year, possibly much longer under different tracking names. The January 2026 campaign is a detected snapshot, not an origin point.
2. AI-assisted malware development is now operational, not theoretical: Dust Specter's use of generative AI to write production malware is verified by code analysis. Defenders should expect continued divergence from known malware patterns as AI tooling becomes standard in threat actor workflows across the entire sophistication spectrum, not just elite groups.
3. Compromising victim infrastructure for payload hosting is a deliberate strategy: Using the legitimate ca.iq government domain to serve GHOSTFORM is not laziness — it is a calculated trust exploitation. Targets are less likely to flag downloads from familiar government domains. Detection logic that treats known-good domains as inherently safe will miss this vector entirely.
4. ClickFix is now an Iranian APT technique: The Webex lure observed in July 2025 used ClickFix-style copy-paste PowerShell delivery. This technique originated in financially motivated cybercriminal ecosystems and has now been adopted by nation-state actors. Any organization that has not addressed ClickFix-style delivery in its user security training is behind.
5. Iraq's Ministry of Foreign Affairs remains a high-value, persistent target: Organizations in or affiliated with the Iraqi government — particularly those with diplomatic, foreign policy, or Ministry-adjacent functions — should treat this as an active and ongoing threat environment, not a one-time incident. The adversary has demonstrated consistent intent and a willingness to re-engage after exposure.

Dust Specter, whatever its final attribution turns out to be, is a useful case study in how modern APT operations blend old strategic objectives with new technical tools. The Ministry of Foreign Affairs has been a target for years. The infrastructure playbook of compromising victim government domains is established doctrine. What is new is the AI-generated code, the invisible GUI evasion, and the ClickFix delivery — incremental upgrades layered onto a campaign that has been running long enough that the attackers know their environment well. That kind of persistence, combined with accelerating development velocity from AI assistance, is the actual threat to model.

Sources

• Primary Research Zscaler ThreatLabz — "Dust Specter APT Targets Gov't Officials in Iraq" (March 2026)
• Additional Coverage Infosecurity Magazine — "Iranian Cyber Threat Actor Targets Iraqi Government Officials" (March 2026)
• Context: APT34 Iraq 2024 Check Point Research — "The Unraveling of an Iranian Cyber Attack Against the Iraqi Government" (September 2024)
• Context: APT34 Iraq & Yemen 2025 Dark Reading — "Iran's MOIS-Linked APT34 Spies on Allies Iraq & Yemen" (April 3, 2025)
• Context: BladedFeline / Kurdish & Iraqi Officials ESET WeLiveSecurity — "BladedFeline: Whispering in the dark" (June 2025)
• Context: BladedFeline / Kurdish & Iraqi Officials (Coverage) The Record — "Iran-linked hackers target Kurdish and Iraqi officials" (June 2025)
• Context: APT34 Iraq September 2024 The Record — "Iran-linked hackers target Iraqi government in new campaign" (September 2024)
• Attribution Reference MITRE ATT&CK — OilRig / APT34 Group Profile (G0049)
• Iran APT Landscape CSIS — "Beyond Hacktivism: Iran's Coordinated Cyber Threat Landscape"