A sophisticated cyberattack campaign, attributed to a suspected Iran-linked threat actor known as Dust Specter, has been targeting government officials in Iraq, according to researchers at Zscaler ThreatLabz. The attacks, first observed in January 2026, involve impersonation of Iraq’s Ministry of Foreign Affairs and the deployment of several previously unseen malware families.
The malware cluster used in the campaign includes SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. Each of these tools is designed to perform distinct stages of the attack, from initial infection and reconnaissance to data exfiltration and persistence. Analysts noted that Dust Specter employs multiple infection chains to increase the success rate and complicate detection efforts.
Security expert Sudeep Singh explained that Dust Specter uses randomly generated URI paths for command-and-control (C2) communications. These paths include checksum values to confirm that requests come from legitimate infected systems. Additional evasion techniques, such as User-Agent verification and geofencing, are applied to ensure that malware executes only on intended targets, limiting exposure to security researchers and automated defenses.
A significant feature of the campaign is the compromise of Iraqi government infrastructure itself to stage malicious payloads. This approach allows attackers to appear as legitimate communications from trusted sources, making detection by victims and security systems more difficult. Zscaler ThreatLabz reports that these techniques are consistent with a highly skilled actor seeking access to sensitive government information while avoiding attribution.
The campaign is part of a broader trend of state-affiliated threat actors targeting critical infrastructure and government systems in the Middle East. Analysts warn that such malware operations can have serious implications, including the theft of confidential communications, disruption of administrative functions, and the potential to manipulate sensitive political or military data.
Dust Specter’s use of novel malware families demonstrates the evolving capabilities of cyber threat actors in the region. SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM were not previously documented in public cybersecurity research, indicating significant resources and expertise behind the operation. Each tool has been engineered to evade traditional signature-based security solutions, relying on advanced techniques such as delayed execution, anti-analysis measures, and encryption of payloads.
Security agencies in Iraq have been urged to increase monitoring, implement stricter endpoint protection, and conduct thorough audits of government systems. Coordination with international cybersecurity organizations may also help in identifying, mitigating, and attributing future attacks.
The Dust Specter campaign highlights the increasing risks to government networks in geopolitically sensitive regions. By exploiting trusted communication channels and deploying advanced malware, threat actors can access high-value data while minimizing the likelihood of detection. Ongoing research and vigilance remain crucial to defending national digital infrastructure and ensuring operational continuity.
