Attribution
Assessed by Zscaler ThreatLabz with medium-to-high confidence to be an Iran-nexus APT group, based on overlapping TTPs, victimology (Iraqi government targeting), lightweight custom .NET tooling with minimal obfuscation, and lure themes consistent with previously observed Iran-linked cyber-espionage operations. "Dust Specter" is Zscaler's internal tracking designation; the group has not been publicly linked to a named, previously catalogued Iranian cluster (e.g., no confirmed overlap published with MuddyWater, APT34/OilRig, etc.), so attribution to a specific Iranian sponsor remains uncertain.