Researchers have discovered a new set of malware used in attacks against Iraqi entities allegedly including the Prime Minister’s Office and the Ministry of Foreign Affairs. The malware dubbed “Veaty” and “Spearal” have ties to malware families used by APT34, a cyber group affiliated with the Iranian Ministry of Intelligence and Security also known as “OilRig”. The malware identified in the campaign is bespoke and along with the techniques deployed, resembles custom backdoors such as “Karkoff” and “Saitama” previously associated with APT34. While the original infection pathway is unknown, the initial files used to kick-off the campaign were likely delivered to victims through social engineering. These initial files use double extensions to appear legitimate. Examples of file names include “Avamer.pdf.exe” and “Protocol.pdf.exe”. These files execute PowerShell or Pyinstaller scripts to deploy the “Veaty” and “Spearal” malware payloads and configuration files and maintain persistence by modifying the Windows registry under “\CurrentVersion\Run”. The “Spearal” malware is a .NET backdoor that uses DNS tunneling using a custom Base32 encoding scheme for command-and-control (C2) communication. “Spearal” can execute PowerShell commands, read file contents, retrieve data from the C2 server, and send data back to the C2 server. The “Veaty” malware is also a .NET-based malware which uses compromised email accounts in the victim organization for C2 communications. In the malware sample analyzed by researchers, the malware used email accounts at the gov-iq[.]net domain to execute commands. The malware can upload and download files, execute commands, and run scripts through specific mailboxes. Researchers also identified an XML configuration file capable of setting up an SSH tunnel which the threat actor likely used as a third backdoor. The tactics, techniques, and procedures used in this campaign suggest that APT34/OilRig is responsible. The use of custom C2 mechanisms is notable among these newly identified backdoors. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.