Loading story…
An Iran-nexus threat operation tracked as Dust Specter impersonated Iraq’s Ministry of Foreign Affairs to compromise Iraqi government officials using multiple newly identified malware families: SplitDrop, TwinTask, TwinTalk, and GhostForm. Reporting indicates the activity was first identified in January and used at least two delivery chains: (1) a password-protected RAR archive containing a WinRAR-spoofing .NET dropper (SplitDrop) that decrypts and deploys follow-on payloads, and (2) a GhostForm chain that abuses a Google Forms-themed lure and executes PowerShell in memory.
Technical details described include TwinTask polling for commands and enabling PowerShell-based execution, while TwinTalk communicates with a C2 server for tasking. Researchers also noted development artifacts consistent with generative AI-assisted coding, including emojis/unicode in source code and other “placeholder”-style patterns, suggesting AI may have been used to produce functional malicious code rather than only support planning or content generation. Attribution was assessed with medium-to-high confidence to an Iran-linked actor based on overlaps in victimology and tradecraft with known Iranian APT activity.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
When reporting the campaign in early March 2026, Zscaler ThreatLabz said code artifacts in TWINTALK and GHOSTFORM suggested possible generative-AI assistance in malware development. Reported indicators included emoji and Unicode patterns and a placeholder seed value in the code.
Following analysis of the January 2026 intrusions, Zscaler ThreatLabz assessed with medium-to-high confidence that Dust Specter is linked to an Iran-nexus threat actor. The attribution was based on overlaps in tooling, techniques, infrastructure, and victimology.
During the January 2026 campaign, Dust Specter delivered previously undocumented malware named SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. One chain used a password-protected RAR and DLL sideloading through legitimate binaries, while the other used a single-binary GHOSTFORM implant with in-memory PowerShell execution and a fake Arabic Google Form lure.
In January 2026, attackers tracked as Dust Specter targeted Iraqi government officials by impersonating Iraq’s Ministry of Foreign Affairs in social-engineering lures. The campaign used compromised Iraqi government-related infrastructure to stage payloads.
In July 2025, infrastructure later linked to Dust Specter was used in a ClickFix-style campaign impersonating a Cisco Webex Government meeting invite. Victims were tricked into running PowerShell that downloaded a payload and established persistence via a scheduled task.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026
An Iran-linked threat group tracked as **Screening Serpens**—also known as `UNC1549`, `Smoke Sandstorm`, and `Iranian Dream Job`—ran coordinated cyberespionage operations against organizations in the United States, Israel, the United Arab Emirates, and likely two additional Middle Eastern targets. The activity, observed between February and April 2026, relied on highly tailored recruitment- and meeting-themed social engineering aimed largely at technology-sector professionals as regional tensions escalated in the Middle East. Researchers said the group deployed six new remote-access trojan variants across two malware families, **MiniUpdate** and **MiniJunk V2**, using **DLL sideloading** and Azure-hosted command-and-control infrastructure dedicated to individual targets or malware variants. A notable shift in tradecraft was the use of **AppDomainManager hijacking** in .NET applications, allowing the attackers to disable ETW and other security controls through legitimate configuration files before the host application launched. **MiniUpdate** supported command execution, DLL loading, process control, file theft, UAC elevation, and scheduled-task persistence, while **MiniJunk V2** used staged loaders, junk padding, and heavy obfuscation to hinder analysis and detection.
Sep 1, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026