Iran-nexus APT Dust Specter targets Iraq officials with new malware

Zscaler ThreatLabz observed a January 2026 campaign attributed with medium-to-high confidence to the Iran-linked APT Dust Specter targeting Iraqi government officials via spear-phishing that delivered new .NET malware families (SPLITDROP, TWINTASK, TWINTALK, GHOSTFORM) using password-protected archives, DLL sideloading, in-memory execution, and ClickFix-style lures; the report details two attack chains, C2 techniques, persistence mechanisms, IOCs, and notes possible generative-AI involvement in the malware development.