Dust Specter

Dust Specter is a suspected Iran-nexus threat actor first documented by Zscaler ThreatLabz in early 2026, targeting Iraqi government officials with a focus on the Ministry of Foreign Affairs. The group uses ClickFix social engineering — including fake Cisco Webex meeting invitations and Arabic-language Google Forms — to lure victims into executing malicious payloads. Its custom .NET-based toolset includes the SPLITDROP dropper, TWINTASK worker module, TWINTALK command and control orchestrator, and the GHOSTFORM consolidated remote access trojan, which uses invisible Windows forms and in-memory PowerShell execution to evade detection. The group compromised legitimate Iraqi government infrastructure to host payloads and employed DLL sideloading via signed binaries such as VLC and WingetUI. Malware codebase artifacts including emojis and Unicode placeholder values suggest AI-assisted development. Infrastructure overlaps with MuddyWater-linked campaigns have been observed, though Dust Specter is tracked as a distinct operational cluster with its own custom toolset.