Iran‑Nexus APT ‘Dust Specter’ Hits Iraqi Officials with AI‑Assisted Malware and Novel RATs
In January 2026, a cyberattack targeting government officials in Iraq was identified. The threat group, known as Dust Specter, impersonated Iraq’s Ministry of Foreign Affairs to deceive targets into downloading malicious files.
In January 2026, a cyberattack targeting government officials in Iraq was identified. The threat group, known as Dust Specter, impersonated Iraq’s Ministry of Foreign Affairs to deceive targets into downloading malicious files.
The attack introduced four new malware tools: SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. These tools suggest the involvement of a state-linked actor due to their sophistication. Researchers attribute this to an Iran-nexus threat actor based on similarities with known Iranian APT groups.
The initial attack chain involved a RAR archive named mofa-Network-code.rar , disguised as an official document. Upon opening, a .NET binary, SPLITDROP, decrypted an embedded payload using AES-256 encryption, dropping malicious files on the victim's machine while displaying a false error message.
The second attack chain utilized GHOSTFORM, which presented a fake Arabic Google Form survey while malware executed undetected.
Research indicates the use of AI in developing the malware, with evidence such as emojis and unicode characters in the source code of TWINTALK and GHOSTFORM, and a hardcoded seed value linked to AI-generated code.
In January 2026, a cyberattack targeting government officials in Iraq was identified.
This signifies a shift where AI is used not only for planning but also for writing functional malicious code.
The same group is linked to a ClickFix-style attack from July 2025, which involved a webpage mimicking a Cisco Webex Government meeting invitation, leading victims to execute a PowerShell command that downloaded a malicious binary.
Technical Exploits: DLL Sideloading and Persistence
In the first attack chain, SPLITDROP extracted its payload and launched VLC Media Player, which sideloaded a malicious DLL named libvlc.dll . This technique exploits the trust placed in recognized applications and does not require elevated privileges.
TWINTASK, the malicious DLL, polled a local text file for Base64-encoded PowerShell commands from the C2 orchestrator. It then launched WingetUI.exe, which sideloaded another malicious DLL, hostfxr.dll, acting as the C2 orchestrator.
To verify requests, TWINTALK generated dynamic URI paths with checksums, and the C2 server applied geofencing to restrict responses to specific regions.
Persistence was achieved via Windows Registry Run keys, ensuring the relaunch of VLC.exe and WingetUI.exe after system restarts. GHOSTFORM delayed its execution by launching an invisible Windows form.
Implement strict application allowlisting to prevent unauthorized DLL sideloading. Configure email and web gateways to block password-protected archives from unverified sources. Enable PowerShell script block logging and monitor Windows Registry Run keys for unexpected entries. Flag outbound HTTPS traffic with randomized URI patterns and non-standard JWT authorization headers.
Based on reporting by Cyber Security News.
