apt

Dust Specter

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Attribution

Assessed by Zscaler ThreatLabz with medium-to-high confidence to be an Iran-nexus APT group, based on overlapping TTPs, victimology (Iraqi government targeting), lightweight custom .NET tooling with minimal obfuscation, and lure themes consistent with previously observed Iran-linked cyber-espionage operations. "Dust Specter" is Zscaler's internal tracking designation; the group has not been publicly linked to a named, previously catalogued Iranian cluster (e.g., no confirmed overlap published with MuddyWater, APT34/OilRig, etc.), so attribution to a specific Iranian sponsor remains uncertain.

Origin

Iran

First seen

2025-07 (earliest related ClickFix activity reusing the same C2 domain; primary campaign observed January 2026)

Last active

2026-01

Motivation

Cyber-espionage / intelligence collection against government targets

Attribution confidence

medium

MENA targeting

Iraq

Sectors

Government, Ministry of Foreign Affairs

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iraq (Government, Ministry of Foreign Affairs sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Gaza Cybergang / MoleratsactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
WIRTEactorTechnique overlap
SideWinderactorTechnique overlap
BahamutactorTechnique overlap
Imperial Kitten (CURIUM)actorTechnique overlap
APT33actorTechnique overlap
MuddyWateractorTechnique overlap
Tropic Trooper

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Dust Specter's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

9 / 14

Mean robustness (of covered)

Useful?

Uses

Deobfuscate/Decode Files or InformationtechniqueATT&CK mapping
User Execution: Malicious FiletechniqueATT&CK mapping
Command and Scripting Interpreter: PowerShelltechniqueATT&CK mapping
Boot or Logon Autostart Execution: Registry Run Keys / Startup FoldertechniqueATT&CK mapping
Scheduled Task/Job: Scheduled TasktechniqueATT&CK mapping
Phishing: Spearphishing AttachmenttechniqueATT&CK mapping
Develop Capabilities: MalwaretechniqueATT&CK mapping
Hijack Execution Flow: DLLtechniqueATT&CK mapping
User Execution: Malicious Copy and PastetechniqueATT&CK mapping
Compromise Infrastructure: ServertechniqueATT&CK mapping
Acquire Infrastructure: DomainstechniqueATT&CK mapping
Application Layer Protocol: Web ProtocolstechniqueATT&CK mapping
System Information DiscoverytechniqueATT&CK mapping
Data Encoding: Standard EncodingtechniqueATT&CK mapping