Dust Specter

Dust Specter is a suspected Iran-nexus APT cluster identified by Zscaler ThreatLabz and publicly reported in March 2026. The group was observed conducting a targeted campaign against Iraqi government officials in January 2026, impersonating Iraq’s Ministry of Foreign Affairs. Reporting describes the activity as targeted espionage against Iraqi government personnel and diplomats. The campaign used phishing and social-engineering lures, including Ministry of Foreign Affairs-themed messages, a fake Google Form survey, and a ClickFix-style lure disguised as a Cisco Webex meeting page. Zscaler assessed with medium-to-high confidence that the operation was conducted by an Iran-nexus threat actor based on overlap in TTPs and victimology. Dust Specter used four newly identified malware families: SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. SPLITDROP was a .NET dropper disguised as a WinRAR application and delivered TWINTASK and TWINTALK. TWINTASK executed PowerShell commands from a local file, while TWINTALK acted as the command-and-control orchestrator. GHOSTFORM consolidated similar functionality into a single binary, executed commands directly in memory, displayed a fake Google Form lure, used invisible Windows forms for delayed execution, and used mutex checks to avoid multiple instances. Observed tradecraft included password-protected RAR delivery, registry-key persistence, DLL sideloading using legitimate software including VLC and WingetUI, randomized beacon delays, custom URI paths, JWT-based C2 communications, script execution, file upload/download capability, and in-memory execution to reduce filesystem traces. ThreatLabz also reported code artifacts in TWINTALK and GHOSTFORM, including emojis and Unicode text, that it said may indicate generative-AI-assisted malware development. The TWINTALK C2 domain meetingapp[.]site was also linked to Dust Specter activity observed in July 2025.