Iranian Cyber Threat Actor Targets Iraqi Government Officials in AI-Powered Campaign

An Iran-linked APT referred to as Dust Specter conducted a targeted campaign in January 2026 against Iraqi government officials by impersonating Iraq’s Ministry of Foreign Affairs and hosting malicious payloads on compromised government-related infrastructure. Researchers identified multiple previously undocumented malware families (SplitDrop, TwinTask, TwinTalk, GhostForm), two distinct attack chains (RAR dropper with DLL sideloading and a consolidated .NET RAT using in-memory PowerShell), reuse of C2 infrastructure, social-engineering lures (Webex-style pages and Google Forms), and code artifacts suggesting the use of generative AI in malware development.