Dust Specter APT — Iran-Nexus Targeting Iraqi Government Officials with TWINTASK/GHOSTFORM Malware — Threadlinqs Intelligence
As of 2026-05-30, Dust Specter APT — Iran-Nexus Targeting Iraqi Government Officials with TWINTASK/GHOSTFORM Malware is a high-severity apt threat attributed to Dust Specter (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0170 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: Dust Specter · Iran · ESPIONAGE
Zscaler ThreatLabz discovered a suspected Iran-nexus threat actor dubbed Dust Specter targeting government officials in Iraq with previously undocumented malware including SPLITDROP dropper, TWINTASK
Dust Specter is a previously unreported, suspected Iran-nexus advanced persistent threat actor discovered by Zscaler ThreatLabz targeting government officials in Iraq. The campaign deploys four previously undocumented malware components — SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM — through two distinct attack chains that demonstrate sophisticated operational security and stealth.
Attack Chain 1 begins with a password-protected RAR archive named 'mofa-Network-code.rar' (password: 92,110-135_118-128) containing a 32-bit .NET binary disguised as a WinRAR application. This binary, dubbed SPLITDROP, functions as an AES-256-CBC encrypted dropper that prompts the victim for a password, then decrypts an embedded resource (CheckFopil.PolGuid.zip) using PBKDF2 with HMAC-SHA1 (10,000 iterations, 256-bit key) derived from the entered password. Upon successful decryption, SPLITDROP extracts contents to C:\ProgramData\PolGuid\ and displays a deceptive error message ('The download did not complete successfully') while operating in the background.
SPLITDROP then launches a legitimate VLC media player binary (VLC.exe) from the extracted directory, which sideloads a malicious DLL named libvlc.dll — the TWINTASK component. TWINTASK is a worker module that enters an infinite polling loop every 15 seconds, checking C:\ProgramData\PolGuid\in.txt for Base64-encoded commands. It strips the first character (an anti-analysis measure), decodes the remaining Base64, and executes the result via PowerShell with a 600-second timeout. Output and errors are captured to C:\ProgramData\PolGuid\out.txt.
TWINTASK's initial in.txt comes prepopulated with commands that establish persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry keys for both VLC.exe and WingetUI.exe, and launches the second sideloading chain. WingetUI.exe (a legitimate graphical package manager interface) sideloads hostfxr.dll — the TWINTALK C2 orchestrator.
TWINTALK is a 32-bit .NET DLL that implements the C2 communication protocol. It generates unique bot IDs stored in programTemp.log, constructs requests with runtime-generated URI paths using random hex strings with checksums (seeded 0xABCDEF), and authenticates using JSON Web Tokens (JWT) signed with HS256 and a single underscore character as the secret. The JWT iat field stores bot ID and version, camouflaging the beacon as a standard timestamp. TWINTALK uses randomized beaconing delays (108-180 seconds base, with -10% to +50% jitter) and the C2 server randomizes JSON response key names on each response to evade pattern-matching detection. TWINTALK supports three command types: command execution (type 0, via file-based coordination with TWINTASK), file download (type 1), and file upload (type 2 with Base64 encoding plus random character prepend).
Attack Chain 2 consolidates all functionality into a single binary called GHOSTFORM. Key differences include: use of Arabic-language Google Forms masquerading as Iraqi Ministry of Foreign Affairs official surveys as decoy lures; creative delayed execution via invisible Windows forms (opacity 0.001, size 10x15, hidden from taskbar) instead of sleep APIs; bot ID derived from the .NET assembly creation timestamp rather than random generation; and a Global\_ mutex for single-instance enforcement. GHOSTFORM eliminates the filesystem footprint of file-based polling by using in-memory PowerShell execution.
The campaign reflects established Iran-nexus tradecraft — targeting Iraqi government officials aligns with Iran's strategic intelligence collection priorities in its sphere of influence. The malware family names, C2 architecture, and operational patterns suggest a well-resourced team with software development discipline. The split worker/orchestrator architecture in Attack Chain 1 and the consolidated approach in Attack Chain 2 may represent an evolution in the actor's tooling or parallel development tracks for different operational requirements.
The UK's NCSC issued a c
Target sectors: government, diplomatic, military, foreign-affairs
Target regions: Iraq, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1566.001, T1059.001, T1204.002, T1547.001, T1574.002, T1574.002, T1027.013, T1140, T1036.005, T1564.003