Dust Specter APT — Iran-Nexus Targeting Iraqi Government Officials with TWINTASK/GHOSTFORM Malware
Dust Specter APT (TL-2026-0170) is a high-severity advanced persistent threat campaign, first published 2026-03-02. It is attributed to Dust Specter (Iran) with medium confidence, affects Multiple Windows endpoints, maps to 18 MITRE ATT&CK techniques (T1005, T1027.013, T1036.005), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-0170
- Threat ID
- TL-2026-0170
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-03-02
- Last reviewed
- 2026-03-02
- Attribution
- Dust Specter
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government, diplomatic, military, foreign-affairs
- Target regions
- Iraq, Middle East
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Dust Specter APT
Malware and tooling: GHOSTFORM, SPLITDROP, TWINTALK, TWINTASK
Zscaler ThreatLabz discovered a suspected Iran-nexus threat actor dubbed Dust Specter targeting government officials in Iraq with previously undocumented malware including SPLITDROP dropper, TWINTASK worker module, TWINTALK C2 orchestrator, and GHOSTFORM consolidated backdoor. The campaign uses password-protected RAR archives, VLC DLL sideloading, file-based command polling, and Arabic-language Google Form lures masquerading as Iraqi Ministry of Foreign Affairs surveys.
How Dust Specter APT works
Dust Specter is a previously unreported, suspected Iran-nexus advanced persistent threat actor discovered by Zscaler ThreatLabz targeting government officials in Iraq. The campaign deploys four previously undocumented malware components — SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM — through two distinct attack chains that demonstrate sophisticated operational security and stealth.
Attack Chain 1 begins with a password-protected RAR archive named 'mofa-Network-code.rar' (password: 92,110-135_118-128) containing a 32-bit .NET binary disguised as a WinRAR application. This binary, dubbed SPLITDROP, functions as an AES-256-CBC encrypted dropper that prompts the victim for a password, then decrypts an embedded resource (CheckFopil.PolGuid.zip) using PBKDF2 with HMAC-SHA1 (10,000 iterations, 256-bit key) derived from the entered password. Upon successful decryption, SPLITDROP extracts contents to C:\ProgramData\PolGuid\ and displays a deceptive error message ('The download did not complete successfully') while operating in the background.
SPLITDROP then launches a legitimate VLC media player binary (VLC.exe) from the extracted directory, which sideloads a malicious DLL named libvlc.dll — the TWINTASK component. TWINTASK is a worker module that enters an infinite polling loop every 15 seconds, checking C:\ProgramData\PolGuid\in.txt for Base64-encoded commands. It strips the first character (an anti-analysis measure), decodes the remaining Base64, and executes the result via PowerShell with a 600-second timeout. Output and errors are captured to C:\ProgramData\PolGuid\out.txt.
TWINTASK's initial in.txt comes prepopulated with commands that establish persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry keys for both VLC.exe and WingetUI.exe, and launches the second sideloading chain. WingetUI.exe (a legitimate graphical package manager interface) sideloads hostfxr.dll — the TWINTALK C2 orchestrator.
TWINTALK is a 32-bit .NET DLL that implements the C2 communication protocol. It generates unique bot IDs stored in programTemp.log, constructs requests with runtime-generated URI paths using random hex strings with checksums (seeded 0xABCDEF), and authenticates using JSON Web Tokens (JWT) signed with HS256 and a single underscore character as the secret. The JWT iat field stores bot ID and version, camouflaging the beacon as a standard timestamp. TWINTALK uses randomized beaconing delays (108-180 seconds base, with -10% to +50% jitter) and the C2 server randomizes JSON response key names on each response to evade pattern-matching detection. TWINTALK supports three command types: command execution (type 0, via file-based coordination with TWINTASK), file download (type 1), and file upload (type 2 with Base64 encoding plus random character prepend).
Attack Chain 2 consolidates all functionality into a single binary called GHOSTFORM. Key differences include: use of Arabic-language Google Forms masquerading as Iraqi Ministry of Foreign Affairs official surveys as decoy lures; creative delayed execution via invisible Windows forms (opacity 0.001, size 10x15, hidden from taskbar) instead of sleep APIs; bot ID derived from the .NET assembly creation timestamp rather than random generation; and a Global\_ mutex for single-instance enforcement. GHOSTFORM eliminates the filesystem footprint of file-based polling by using in-memory PowerShell execution.
The campaign reflects established Iran-nexus tradecraft — targeting Iraqi government officials aligns with Iran's strategic intelligence collection priorities in its sphere of influence. The malware family names, C2 architecture, and operational patterns suggest a well-resourced team with software development discipline. The split worker/orchestrator architecture in Attack Chain 1 and the consolidated approach in Attack Chain 2 may represent an evolution in the actor's tooling or parallel development tracks for different operational requirements.
The UK's NCSC issued a concurrent warning about heightened Iranian cyberattack risks amid Middle East conflict, providing additional geopolitical context for this campaign's timing. No CVEs are associated with this threat — exploitation relies entirely on social engineering and DLL sideloading of legitimate applications.
MITRE ATT&CK techniques used in TL-2026-0170
collection
T1005 Data from Local System; T1560 Archive Collected Data
defense-evasion
T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hidden Window
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059.001 PowerShell; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
discovery
T1082 System Information Discovery
persistence
T1547.001 Registry Run Keys / Startup Folder
initial-access
T1566.001 Spearphishing Attachment
stealth
resource-development
Affected products and versions in Dust Specter APT
- Multiple — Windows endpoints
Vulnerable versions: Windows 10; Windows 11; Windows Server
Remediation for Dust Specter APT
Immediate actions
- Block known Dust Specter IOCs (file hashes, C2 domains) at perimeter and endpoint
- Hunt for SPLITDROP artifacts: C:\ProgramData\PolGuid\ directory structure, PolGuid.zip
- Hunt for TWINTASK file-based C2: in.txt and out.txt in ProgramData\PolGuid\
- Audit HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unexpected VLC or WingetUI entries
- Search for anomalous VLC.exe or WingetUI.exe execution from ProgramData directories
- Block password-protected RAR archives with 'mofa' or ministry-related filenames at email gateway
Workarounds
- Disable macro execution and script execution from untrusted sources
- Restrict PowerShell execution policy to signed scripts only
- Block VLC.exe and WingetUI.exe execution from C:\ProgramData directories via AppLocker
- Monitor and restrict outbound HTTP/HTTPS from non-browser processes
Longer-term hardening
- Implement application whitelisting to prevent DLL sideloading from non-standard directories
- Deploy EDR with behavioral detection for PowerShell execution from sideloaded DLLs
- Monitor for JWT-authenticated C2 beaconing with randomized URI paths and response key names
- Implement DLL sideloading protection — enforce DLL loading from trusted directories only
- Train government personnel on spear-phishing with password-protected archives and fake government surveys
- Monitor for invisible Windows forms with near-zero opacity as delayed execution technique
- Implement network segmentation for government endpoints handling sensitive communications
Timeline of Dust Specter APT
- ThreadLinqs Intelligence Platform publishes TL-2026-0170 with full MITRE mapping, IOCs, detections, and simulation coverage.
- Two attack chains identified: Chain 1 (split worker/orchestrator with SPLITDROP→VLC sideload→TWINTASK→WingetUI sideload→TWINTALK) and Chain 2 (consolidated GHOSTFORM with in-memory execution).
- GHOSTFORM variant identified using Arabic-language Google Forms impersonating Iraqi Ministry of Foreign Affairs official surveys as social engineering decoys.
- ThreatLabz maps Dust Specter TTPs to MITRE ATT&CK framework — DLL sideloading (T1574.002), PowerShell execution (T1059.001), registry persistence (T1547.001), JWT-based C2 authentication.
- Zscaler ThreatLabz publishes IOCs including malware hashes, C2 infrastructure, and file-based artifacts for Dust Specter campaign.
- UK NCSC issues warning about heightened Iranian cyberattack risks amid ongoing Middle East conflict, providing geopolitical context for Dust Specter campaign timing.
- Zscaler ThreatLabz publishes first public disclosure of Dust Specter APT campaign targeting Iraqi government officials with TWINTASK, TWINTALK, GHOSTFORM, and SPLITDROP malware. Source: https://www.zscaler.com/blogs/security-research/dust-specter-apt-targets-government-officials-iraq
- As of 2026-05-29, this Iran-nexus Dust Specter espionage campaign (SPLITDROP/TWINTASK/TWINTALK/GHOSTFORM, no CVE) remains ACTIVE, disclosed by Zscaler ThreatLabz in March 2026 from January 2026 activity against Iraqi officials. No reporting shows the actor disrupted, the campaign concluded, or a successor superseding it, and Iran-nexus APTs persist with custom AI-assisted malware.
Sources cited for Dust Specter APT
- Zscaler ThreatLabz: Dust Specter APT Targets Government Officials in Iraq
- UK NCSC Warning: Iranian Cyberattack Risks Amid Middle East Conflict
- MITRE ATT&CK — APT33 (Peach Sandstorm) — Iran-Nexus Reference Group
- MITRE ATT&CK — APT39 (Chafer/Remix Kitten) — Iran MOIS Reference Group
- MITRE ATT&CK — Agrius (Pink Sandstorm) — Iran MOIS Threat Actor
- MITRE ATT&CK — T1574.002 DLL Side-Loading
- MITRE ATT&CK — T1059.001 PowerShell
- Zscaler ThreatLabz: Targeted Attacks on Oil and Gas Supply Chain Industries in the Middle East
Threats related to Dust Specter APT
Detection coverage for TL-2026-0170
As of 2026-03-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0170 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.