Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Dust Specter APT Targets Government Officials in Iraq
Threat Actors
Excerpt
IntroductionIn January 2026, Zscaler ThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. Due to significant overlap in tools, techniques, and procedures (TTPs), as well as victimology, between this campaign and activity associated with Iran-nexus APT groups, ThreatLabz assesses with…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://meetingapp.site/webexdownload').Result.Content.ReadAsByteArrayAsync().Result | High | Score 58/100 | First seen |
| URL | https://meetingapp.site/webexdownload | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…