Iran‑Linked “Dust Specter” APT Deploys AI‑Aided Malware Against Iraqi Officials

Dust Specter, assessed as an Iran‑nexus APT, ran a January 2026 campaign against Iraqi government officials using custom .NET malware families (SPLITDROP, TWINTASK, TWINTALK) and a consolidated RAT (GHOSTFORM) delivered via passworded archives and social‑engineering lures; tactics include DLL sideloading, in‑memory PowerShell, JWT‑based C2, and reuse of infrastructure tied to a July 2025 ClickFix operation. The report includes detailed behavioral analysis and a list of network IOCs (domains and URLs) for detection and mitigation.