In January 2026, Zscaler ThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP , TWINTASK , TWINTALK, and GHOSTFORM . Due to significant overlap in tools, techniques, and procedures (TTPs), as well as victimology, between this campaign and activity associated with Iran-nexus APT groups, ThreatLabz assesses with medium-to-high confidence that an Iran-nexus threat actor conducted this operation. ThreatLabz tracks this group internally as Dust Specter . As additional high-confidence indicators become available, ThreatLabz will update our attribution accordingly. In this blog post, ThreatLabz examines the technical details of two attack chains: Attack Chain 1, which involves the newly identified SPLITDROP dropper and the TWINTASK and TWINTALK backdoors, and Attack Chain 2, which involves the GHOSTFORM remote access trojan (RAT).
The following sections cover Attack Chain 1 and Attack Chain 2, which ThreatLabz observed in-the-wild during this campaign. Attack Chain 1 uses a split architecture with two components, a worker module (TWINTASK) and a C2 orchestrator (TWINTALK), that coordinate through a file-based polling mechanism. Attack Chain 2 consolidates the same functionality into a single binary (GHOSTFORM).
Attack Chain 1 is delivered in a password-protected RAR archive named mofa-Network-code.rar . The password for this archive is: 92,110-135_118-128 . A 32-bit .NET binary, disguised as a WinRAR application, is present inside this archive and starts the attack chain on the endpoint. This binary functions as a dropper and ThreatLabz named it SPLITDROP because it drops two modules that we named TWINTASK and TWINTALK.
Upon being launched, SPLITDROP displays a dialog box prompting the victim to enter a password to extract an archive file. SPLITDROP checks for the presence of C:\ProgramData\PolGuid.zip ; if the file already exists, SPLITDROP does not continue execution. If the file does not exist and the correct password is entered in the password form, SPLITDROP proceeds to decrypt an embedded resource named CheckFopil.PolGuid.zip . Before decrypting the resource, SPLITDROP displays a message box stating, “The download did not complete successfully,” to distract the victim while it operates in the background.
Because the embedded resource is encrypted using AES-256 in CBC mode with PKCS7 padding, SPLITDROP derives the salt, initialization vector (IV), and ciphertext as follows:
A key derivation function (KDF) is then used to derive the encryption key from the password entered by the victim in the password form. The KDF uses PBKDF2 with HMAC-SHA1 as the pseudorandom function, 10,000 iterations, and a 256-bit key size. The decrypted resource is written to the archive file at C:\programData\PolGuid.zip , and the contents of the ZIP archive are extracted to C:\programData\PolGuid\ .
The figure below shows the directory structure after extraction.
Figure 1: Contents of C:\programData\PolGuid\ after extraction.
Finally, a legitimate VLC.exe (the popular open source media player) binary is executed from C:\programData\PolGuid\VLC\VLC.exe to continue to the stage of the attack chain.
Upon being launched, VLC.exe sideloads the malicious DLL libvlc.dll which was extracted alongside VLC.exe in the same directory by SPLITDROP. ThreatLabz named this malicious component TWINTASK .
TWINTASK functions as a worker module, and its main purpose is to poll a file for new commands available for execution and run them using PowerShell. TWINTASK enters an infinite loop and performs the following actions every 15 seconds:
TWINTASK captures the script output and any errors in C:\ProgramData\PolGuid\out.txt .
When TWINTASK is launched, in.txt comes prepopulated with commands that are used to establish persistence on the machine and initiate the stage of the attack chain. Below are the initial decoded contents of in.txt .
Below are the key functions of the PowerShell script that TWINTASK runs on first launch:
Once WingetUI.exe (a legitimate graphical interface application for package managers) is launched by the worker module, it sideloads the malicious DLL hostfxr.dll that is present alongside WingetUI.exe in the same directory. ThreatLabz named this malicious component TWINTALK .
TWINTALK is a 32-bit .NET DLL and functions as a C2 orchestrator whose main purpose is to poll the C2 server for new commands, coordinate with the worker module, and exfiltrate the results of command execution to the C2 server. The C2 orchestrator works in parallel with the previously described worker module to implement a file-based polling mechanism used for code execution.
Upon execution, TWINTALK enters a beaconing loop and delays execution by a random interval before polling the C2 server for new commands. It uses a preconfigured base delay of 120 seconds with jitter that randomizes the delay by generating a random number between -10% and +50% of the base delay (108 seconds to 180 seconds). To implement the delay, TWINTALK creates a nonsignaled unnamed event object using CreateEvent and calls WaitForSingleObject with the randomized delay value calculated above. If the event object cannot be created, TWINTALK falls back to Thread.Sleep() to create the delay. TWINTALK then sends a GET request to the C2 server with the parameters listed in the table below.
For each request, TWINTALK constructs a unique URI path at runtime to evade pattern-based detections. It generates a random 10-character hex string ([0-9a-f]), computes a 6-character checksum (of the 10-character hex string) using a custom algorithm seeded with 0xABCDEF, and concatenates them. The checksum allows the C2 to verify the request is from a valid bot rather than a URL analysis engine.
TWINTALK uses a hardcoded User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 to mimic legitimate browser traffic.
TWINTALK generates a JSON Web Token (JWT) at runtime and sends it in the Authorization: Bearer header; the JWT iat (issued at) field stores the bot ID and bot version, as shown in the code example below.
Table 1: Description of HTTP request headers and URI format used by TWINTALK.
TWINTALK generates a bot ID by checking for the presence of programTemp.log in its execution directory. If the file exists, TWINTALK reads its contents and uses that value to populate the JWT iat field. If the file does not exist, TWINTALK generates a unique random 10-digit ID at runtime, writes it to programTemp.log, and sends it in the JWT iat field. Note that in the TWINTALK samples analyzed by ThreatLabz, the bot version has been set to 0.0.0.0.
Notably, the iat field in a standard JWT represents a Unix epoch timestamp. By storing a 10-digit, randomly generated bot ID in the iat field, the malware can make the request appear more legitimate. The JWT is signed using the HS256 algorithm with a very weak secret (an " _ " character).
TWINTALK deserializes a cleartext JSON object returned by the server to extract C2 commands. Notably, it parses fields by position rather than by JSON key name. During analysis, the server was observed randomizing JSON key names on each response, an evasion method intended to evade pattern-matching–based detection used by network security products. The table below summarizes how TWINTALK maps positional fields.
An ID generated server-side used to synchronize the request and response.
The type of C2 command.
The command body, based on the type of C2 command.
The duration for which the bot should sleep.
Table 2: Mapping between JSON key positions and their functionality for TWINTALK.
TWINTALK supports the following command types.
File download (type 1): TWINTALK decodes the command body to obtain the destination file path. It then uses the transaction ID to build the download URL:
TWINTALK downloads the file from this URL, decodes it, and writes it to the specified path.
Attack Chain 2 consolidates all the functionality of Attack Chain 1 into a single binary. It uses in-memory PowerShell script execution to execute the commands received from the C2 server, reducing the filesystem footprint. Unlike Attack Chain 1, a split architecture with DLL sideloading is not used. ThreatLabz named the second attack chain GHOSTFORM based on its usage of an invisible Windows form for delayed execution and its use of Google Forms as a social engineering lure.
Below are the key differences between Attack Chain 1 and Attack Chain 2.
Figure 2: Google Form displayed by GHOSTFORM to the victim as a social engineering lure.
NOTE : The nature of the bot version numbers seems to indicate that they were generated randomly and a meaningful versioning scheme was not used.
During the decompilation of TWINTALK and GHOSTFORM, ThreatLabz identified the use of emojis and unicode text in the codebase. This unusual coding style strongly suggests that generative AI tools were utilized during the malware's development, and is a trend documented in other campaigns.
Below is the code used to truncate the data sent in the POST request, which includes emojis.
Below is the code used to generate a 6-character checksum from the randomly generated 10-character string used to construct the URI path. The seed value 11259375 (0xABCDEF) appears to be a placeholder commonly found in code generated by AI.
ThreatLabz found that the TWINTALK C2 domain, meetingapp[.]site , was also used by Dust Specter in July 2025 to host a web page disguised as a Cisco Webex meeting invitation. The web page included a link to download the legitimate Cisco Webex software and prompted the victim to choose the “Webex for Government” option. The web page also lures the victim into following the instructions shown in the figure below to retrieve the meeting ID.
Figure 3: Example ClickFix social engineering lure used by Dust Specter.
These instructions are a typical social engineering method employed by threat actors to implement ClickFix-style attacks. Below is the PowerShell command provided on the web page.
The PowerShell command will:
At the time of analysis, ThreatLabz was not able to retrieve the malicious binary from the hxxps://meetingapp[.]site/webexdownload URL.
ThreatLabz attributes this campaign to Dust Specter with moderate confidence, based on the code, victimology, and TTP overlaps described below.
This campaign, attributed with medium-to-high confidence to Dust Specter, likely targeted government officials using convincing social engineering lures impersonating Iraq’s Ministry of Foreign Affairs. ThreatLabz identified previously undocumented lightweight custom .NET-based droppers and backdoors used in this operation. The activity also reflects broader trends, including ClickFix-style techniques and the growing use of generative AI for malware development.
Zscaler’s multilayered cloud security platform detects indicators related to this campaign at various levels.
b8254efd859f5420f1ce4060e4796c08
8621be9e1aa730d1ac8eb06fa8f66d9da70ff293
903f7869a94d88d43b9140bb656f7bb86ef725efc78ef2ff9d12fd7c7c2aca74
mofa-Network-code.rar
Password-protected RAR archive
78275f3fc7e209b85bff6a6f99acc68a
Fc08f8403849c6233978a363f4cdc58cd7041823
6bb0d45799076b3f2d7f602b978a0779868fc72a1188374f6919fbbfba23efce
d5ddf40ba2506c57d3087d032d733e08
682c043443cb81b6c2fde8c5df43333f5d1fec53
797325b3c8a9356dcace75d93cb5cfb7847d2049c66772d4cc2cee821618cb96
Attack Chain 2 (GHOSTFORM)
8f44262afaa171b78fc9be20a0fb0071
1debc4c512ded889464e386739d5d2f61b87ff13
293ee1fe8d36aa79cf1f64f5ddef402bc6939d229c6fca955c7b796119564779
mofa-secret-code-92,110-135_118-128.rar
Password-protected RAR archive
19ab3fd2800f62a47bf13a4cc4e4c124
c79c261457def606c3393dde77c82832a5c0ded3
ad26cd72a83b884a8bc5aaa87309683953e151ebb3fde42eda7bf9a4406e530d
Worker module (TWINTASK)
63702bd6422ec2d5678d4487146ea434
c7dff3a0675f330feb9a7c469f8340369451d122
f3f2dc31f70a105db161a5e7b463b2215d3cbd64ac0146fd68e39da1c279f7ef
C2 orchestrator (TWINTALK)
aa887d32eb9467abba263920e55d6abe
ad97e1bba1d040a237727afdb2787d6867d72b74
6af71297ce7681e64d9a4c5449a7326f17f3f107cb7940ec5e0840390c457a47
Base64-encoded PowerShell command
b19add5ccaa17a1308993e6f3f786b06
51a746c85bd486f223130173b7e674379a51b694
69294ad90aeb7f05e501e7191c95beb14e23da5587dd75557c867e2944a57fdc
Attack Chain 2 (GHOSTFORM)
7f17fa22feaced1a16d4d39c545cdb16
369b56a89b2fce2cbdc36f5a23bdec6067242911
fa51aff99d86a9f1f65aa0ebbf6ca40411d343cea59370851ab328b97e2164bb
ZIP archive containing Attack Chain 2 (GHOSTFORM)
70a9b537b9b7e1b410576d798e6c5043
cb1760c90fb6c399e0125c7aa793efe37c4ce533
a27d53608ab05b5c7cb86bcf4a273435238beeb7e7efd7845375b2aa765f51e2
Attack Chain 2 (GHOSTFORM)
a7561eb023bb2c4025defcfe758d8ac2
df04e36c106691f9fe88e5798e4ae86438bd4f1d
eb5b7275c41de8e98d72696eeac9cba3719f334f8e7974e6b8760ece820b1d0c
mofaSurvey_20_30_oct.zip
ZIP archive containing Attack Chain 2 (GHOSTFORM)
809139c237c4062baecab43570060d67
8735ee29c409b8d101eb3170f011455be41b7a91
3a66ae5942f6feb79cf81ee70451f761253e0e0bde95f0840abdd42a804fad39
Attack Chain 2 (GHOSTFORM)
lecturegenieltd[.]pro
onlinepettools[.]shop
URL hosting ZIP archive containing Attack Chain 2
hxxps://ca[.]iq/packages/mofaSurvey_20_30_oct.zip
Resource development, Acquire Infrastructure: Domains
Dust Specter acquired multiple domains for C2 operations and hosting ClickFix web pages.
Resource Development, Develop Capabilities: Malware
Dust Specter developed custom droppers and backdoors including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM.
Execution, User Execution: Malicious Copy and Paste
Dust Specter employs a ClickFix-style attack, using social engineering to manipulate victims into copying and pasting a PowerShell command into the Run dialog.
Persistence, Modify Registry
TWINTASK sets up persistence by creating Windows Run registry keys, and pointing them to TWINTASK and TWINTALK.
Defense Evasion, Traffic Signaling
C2 servers respond only to requests containing a specific hardcoded User-Agent string. The URI path should contain the correct checksum.
Discovery, System Information Discovery
Dust Specter sends the systeminfo post-compromise command in response to TWINTALK’s beaconing.
Command and Control, Application Layer Protocol: Web Protocols
TWINTALK and GHOSTFORM use HTTPS for C2 communication.
Command and Control, Data Obfuscation: Protocol or Service Impersonation
TWINTALK and GHOSTFORM use a hardcoded User-Agent string that mimics the Chrome browser.
Command and Control, Data Encoding: Standard Encoding
The command body in the C2 response and the command execution result in the C2 request are encoded using Base64 with a randomly generated character prepended to it.
Execution, Hijack Execution Flow: DLL Side-Loading
Both TWINTASK and TWINTALK are launched using the DLL sideloading technique.
Defense Evasion, Deobfuscate/Decode Files or Information
SPLITDROP uses the user-supplied password to decrypt the embedded resource and continue malicious activities.
Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
