Targeted Iranian Attacks Against Iraqi Government Infrastructure

Check Point Research uncovered a targeted campaign against Iraqi government networks deploying two new .NET backdoors—Spearal (DNS tunneling) and Veaty (email-based C2 using compromised gov mailboxes)—plus a passive IIS backdoor (CacheHttp), an HTTP listener, and SSH-tunneling tooling; the report documents detailed C2 protocols, deployment/persistence methods, IOCs (IPs, domains, sample hashes), and attributes the activity to an APT34/MOIS-linked actor.