cyber.hendryadrian.com
Threat Research · zscaler.com

Dust Specter Campaign Targets Iraqi Government Officials With Four Undocumented Malware Tools

· Original article ↗

Summary

Zscaler researchers detail two attack chains targeting Iraqi government officials, using four previously undocumented .NET malware tools. They assess with medium-to-high confidence that the campaign was conducted by an Iran-nexus actor tracked as Dust Specter.

Key points

  • ThreatLabz observed the campaign in January 2026, targeting Iraqi government officials with lures impersonating Iraq’s Ministry of Foreign Affairs.
  • The campaign used compromised Iraq government-related infrastructure to host malicious payloads.
  • One attack chain used SPLITDROP to deploy TWINTASK and TWINTALK, which coordinate through file-based polling and execute PowerShell commands.
  • TWINTALK communicates with command-and-control servers using randomized URI paths, checksum values, and User-Agent verification; it supports command execution and file transfer.
  • The second chain used GHOSTFORM, a .NET RAT that combines the first chain’s functionality in one binary and runs PowerShell scripts in memory.
  • GHOSTFORM used an Arabic-language Google Form as a lure and delayed execution with an almost invisible Windows form and timer.
  • ThreatLabz attributes the activity to the suspected Iran-nexus actor Dust Specter with medium-to-high confidence, citing overlaps in tools, techniques, and victimology.

Article Details

Attack Vectors
  • The campaign targeted government officials in Iraq using lures impersonating Iraq’s Ministry of Foreign Affairs, including a Google Form presented as an official survey.
  • Attack Chain 1 was delivered in password-protected RAR archives containing a binary disguised as a WinRAR application.
  • SPLITDROP extracted files and launched VLC.exe, which sideloaded the malicious libvlc.dll component TWINTASK. A WingetUI.exe binary then sideloaded the malicious hostfxr.dll component TWINTALK.
  • TWINTASK executed Base64-decoded PowerShell commands from a polled file; GHOSTFORM executed commands using in-memory PowerShell.
  • TWINTALK communicated with command-and-control servers over HTTP GET and POST requests, using randomized URI paths and a generated authorization token. It supported command execution, file download, and file upload.
Defensive Notes
  • Monitor for the reported malware and file hashes, and for the C2 domains and specific payload-hosting URL listed in the indicators.
  • Investigate unexpected DLL sideloading involving VLC.exe and WingetUI.exe, particularly from the reported ProgramData paths.
  • Monitor for PowerShell execution associated with C:\ProgramData\PolGuid\in.txt and writes to C:\ProgramData\PolGuid\out.txt.
  • Check for suspicious values named VLC and WingetUI under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
  • Look for unusual outbound HTTP requests with randomized hexadecimal URI paths, checksum-like suffixes, and the reported C2 infrastructure.

Indicators of compromise

TypeIndicatorContext
DOMAINafterworld[.]storeC2 domain used by the campaign.
DOMAINgirlsbags[.]shopC2 domain used by the campaign.
DOMAINlecturegenieltd[.]proC2 domain used by the campaign.
DOMAINmeetingapp[.]siteC2 domain used by the campaign.
DOMAINonlinepettools[.]shopC2 domain used by the campaign.
DOMAINweb14[.]infoC2 domain used by the campaign.
DOMAINweb27[.]infoC2 domain used by the campaign.
MD519ab3fd2800f62a47bf13a4cc4e4c124Hash of the TWINTASK worker module.
MD563702bd6422ec2d5678d4487146ea434Hash of the TWINTALK C2 orchestrator.
MD570a9b537b9b7e1b410576d798e6c5043Hash of a GHOSTFORM sample.
MD578275f3fc7e209b85bff6a6f99acc68aHash of the SPLITDROP dropper.
MD57f17fa22feaced1a16d4d39c545cdb16Hash of a ZIP archive containing GHOSTFORM.
MD5809139c237c4062baecab43570060d67Hash of a GHOSTFORM sample.
MD58f44262afaa171b78fc9be20a0fb0071Hash of the password-protected RAR archive used in the campaign.
MD5a7561eb023bb2c4025defcfe758d8ac2Hash of a ZIP archive containing GHOSTFORM.
MD5aa887d32eb9467abba263920e55d6abeHash of a Base64-encoded PowerShell command artifact used by the campaign.
MD5b19add5ccaa17a1308993e6f3f786b06Hash of a GHOSTFORM sample.
MD5b8254efd859f5420f1ce4060e4796c08Hash of the password-protected RAR archive used to deliver the campaign.
MD5d5ddf40ba2506c57d3087d032d733e08Hash of a GHOSTFORM sample.
SHA11debc4c512ded889464e386739d5d2f61b87ff13Hash of the password-protected RAR archive used in the campaign.
SHA1369b56a89b2fce2cbdc36f5a23bdec6067242911Hash of a ZIP archive containing GHOSTFORM.
SHA151a746c85bd486f223130173b7e674379a51b694Hash of a GHOSTFORM sample.
SHA1682c043443cb81b6c2fde8c5df43333f5d1fec53Hash of a GHOSTFORM sample.
SHA18621be9e1aa730d1ac8eb06fa8f66d9da70ff293Hash of the password-protected RAR archive used to deliver the campaign.
SHA18735ee29c409b8d101eb3170f011455be41b7a91Hash of a GHOSTFORM sample.
SHA1ad97e1bba1d040a237727afdb2787d6867d72b74Hash of a Base64-encoded PowerShell command artifact used by the campaign.
SHA1c79c261457def606c3393dde77c82832a5c0ded3Hash of the TWINTASK worker module.
SHA1c7dff3a0675f330feb9a7c469f8340369451d122Hash of the TWINTALK C2 orchestrator.
SHA1cb1760c90fb6c399e0125c7aa793efe37c4ce533Hash of a GHOSTFORM sample.
SHA1df04e36c106691f9fe88e5798e4ae86438bd4f1dHash of a ZIP archive containing GHOSTFORM.
SHA1fc08f8403849c6233978a363f4cdc58cd7041823Hash of the SPLITDROP dropper.
SHA256293ee1fe8d36aa79cf1f64f5ddef402bc6939d229c6fca955c7b796119564779Hash of the password-protected RAR archive used in the campaign.
SHA2563a66ae5942f6feb79cf81ee70451f761253e0e0bde95f0840abdd42a804fad39Hash of a GHOSTFORM sample.
SHA25669294ad90aeb7f05e501e7191c95beb14e23da5587dd75557c867e2944a57fdcHash of a GHOSTFORM sample.
SHA2566bb0d45799076b3f2d7f602b978a0779868fc72a1188374f6919fbbfba23efceHash of the SPLITDROP dropper.
SHA256797325b3c8a9356dcace75d93cb5cfb7847d2049c66772d4cc2cee821618cb96Hash of a GHOSTFORM sample.
SHA256903f7869a94d88d43b9140bb656f7bb86ef725efc78ef2ff9d12fd7c7c2aca74Hash of the password-protected RAR archive used to deliver the campaign.
SHA256a27d53608ab05b5c7cb86bcf4a273435238beeb7e7efd7845375b2aa765f51e2Hash of a GHOSTFORM sample.
SHA256ad26cd72a83b884a8bc5aaa87309683953e151ebb3fde42eda7bf9a4406e530dHash of the TWINTASK worker module.
SHA256eb5b7275c41de8e98d72696eeac9cba3719f334f8e7974e6b8760ece820b1d0cHash of a ZIP archive containing GHOSTFORM.
SHA256f3f2dc31f70a105db161a5e7b463b2215d3cbd64ac0146fd68e39da1c279f7efHash of the TWINTALK C2 orchestrator.
SHA256fa51aff99d86a9f1f65aa0ebbf6ca40411d343cea59370851ab328b97e2164bbHash of a ZIP archive containing GHOSTFORM.
URLhxxps[:]//ca[.]iq/packages/mofaSurvey_20_30_oct[.]zipSpecific URL on compromised Iraq government-related infrastructure used to host a ZIP archive containing GHOSTFORM.

MITRE ATT&CK

T1036 · MasqueradingThe SPLITDROP binary was disguised as a WinRAR application.T1041 · Exfiltration Over C2 ChannelTWINTALK sent command output and uploaded local files to the C2 server.T1059.001 · PowerShellTWINTASK executed decoded PowerShell scripts, while GHOSTFORM executed commands using in-memory PowerShell.T1071.001 · Web ProtocolsTWINTALK communicated with its C2 server using HTTP GET and POST requests.T1105 · Ingress Tool TransferTWINTALK downloaded files from URLs constructed from the C2 server, generated URI path, and transaction ID.T1547.001 · Registry Run Keys / Startup FolderThe campaign created VLC and WingetUI values under the current user's Windows Run key to launch components at logon.T1574.002 · DLL Side-LoadingVLC.exe sideloaded TWINTASK from libvlc.dll, and WingetUI.exe sideloaded TWINTALK from hostfxr.dll.

Threat Actors

Dust SpecterThreatLabz's internal name for the suspected Iran-nexus threat actor it assesses, with moderate confidence, conducted this campaign.

Malware

GHOSTFORMThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. SPLITDROPtargeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. TWINTALKofficials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. TWINTASKgovernment officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. 

Vendors

ZscalerIn January 2026, Zscaler ThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK,

Products

Google formschain GHOSTFORM based on its usage of an invisible Windows form for delayed execution and its use of Google Forms as a social engineering lure.Microsoft WindowsGHOSTFORM uses creative evasion techniques such as invisible Windows forms along with timers to delay its own execution.PowerShellThe second attack chain uses GHOSTFORM, a .NET-based RAT that consolidates all the functionality of the first attack chain into one binary and uses in-memory PowerShell script execution.VLCFinally, a legitimate VLC.exe (the popular open source media player) binary is executed from C:\programData\PolGuid\VLC\VLC.exe to continue to the next stage of the attack chain.WingetUI"C:\ProgramData\PolGuid\WingetUI\WingetUI.exe";New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'VLC' -Value 'C:\ProgramData\PolGuid\VLC\vlc.exe' -PropertyType String;New-ItemProperty

Countries

IraqThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and

Industries

GovernmentIn January 2026, Zscaler ThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK,

Related Articles