Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus APT cluster called Dust Specter targeted Iraqi government officials using social-engineered lures impersonating the Ministry of Foreign Affairs to deliver novel .NET malware families (SPLITDROP, TWINTASK, TWINTALK) and an evolved single-binary implant (GHOSTFORM). The campaign used compromised Iraqi infrastructure to host payloads, file- and fileless execution paths (including in-memory PowerShell), C2 evasion (randomized URIs, checksums, geofencing, User-Agent validation), and reuse of domains tied to prior campaigns; Zscaler attributes the activity with medium-to-high confidence and notes possible generative-AI assistance in malware development.