Loading story…
Check Point Research reported that Iranian-linked operators conducted targeted malware attacks against Iraqi government infrastructure, indicating a focused espionage or disruptive campaign against state networks. The activity was aimed at government entities in Iraq and was attributed to Iranian threat actors based on the researchers’ investigation.
The report describes a deliberate intrusion set involving malware used against Iraqi public-sector systems, underscoring ongoing cyber operations in the region in which nation-state-aligned groups target neighboring governments for intelligence collection and strategic access. The findings add to evidence that Iraqi government networks remain a priority target in broader Iran-linked cyber activity.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point Research released a detailed technical analysis of the WezRat malware. This added new technical detail to the previously disclosed campaign involving Iranian malware activity targeting Iraqi government infrastructure.
Check Point Research published findings on a targeted campaign described as Iranian malware attacks against Iraqi government infrastructure. The reference indicates public disclosure of the activity but provides no additional incident details in the supplied content.
Bitdefender published a technical blog post analyzing BellaCiao, described as an Iranian malware strain. This represents an earlier public disclosure and technical examination separate from the later Check Point reporting on WezRat and attacks on Iraqi government infrastructure.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourceresearch.checkpoint.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-sponsored threat actors have intensified their cyber operations, targeting government officials, defense sector personnel, and dissidents through sophisticated espionage and disruptive campaigns. The APT42 group, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), has launched the 'SpearSpecter' campaign, employing highly personalized social engineering tactics to compromise senior defense and government officials, as well as their family members. These operations involve building trust over extended periods and leveraging fake conference invitations or meetings to deliver malicious payloads. Other Iranian-linked groups, such as Ferocious Kitten, have focused on targeting dissidents and activists with spear-phishing attacks that deploy custom malware like MarkiRAT, which features advanced data exfiltration and persistence techniques. In parallel, the DEV-1084 group, operating under the 'DarkBit' persona and closely associated with the Iranian state-linked MERCURY group, has conducted ransomware campaigns that prioritize destruction over financial gain. These attacks combine on-premises encryption with the mass deletion of cloud resources, effectively wiping out victim environments and aligning with broader strategic objectives of disruption and psychological impact. Technical analysis has revealed shared infrastructure and tools between DEV-1084 and MERCURY, further solidifying the connection to Iran’s Ministry of Intelligence and Security (MOIS). These coordinated campaigns underscore the evolving threat landscape posed by Iranian APTs, which blend espionage, destructive attacks, and advanced social engineering to achieve their objectives.
Jul 12, 2026
An Iran-nexus threat operation tracked as **Dust Specter** impersonated Iraq’s *Ministry of Foreign Affairs* to compromise Iraqi government officials using multiple newly identified malware families: **SplitDrop**, **TwinTask**, **TwinTalk**, and **GhostForm**. Reporting indicates the activity was first identified in January and used at least two delivery chains: (1) a password-protected RAR archive containing a WinRAR-spoofing .NET dropper (**SplitDrop**) that decrypts and deploys follow-on payloads, and (2) a **GhostForm** chain that abuses a Google Forms-themed lure and executes PowerShell in memory. Technical details described include **TwinTask** polling for commands and enabling **PowerShell**-based execution, while **TwinTalk** communicates with a C2 server for tasking. Researchers also noted development artifacts consistent with **generative AI-assisted coding**, including emojis/unicode in source code and other “placeholder”-style patterns, suggesting AI may have been used to produce functional malicious code rather than only support planning or content generation. Attribution was assessed with medium-to-high confidence to an Iran-linked actor based on overlaps in victimology and tradecraft with known Iranian APT activity.
Jun 29, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026