Iran-Linked Dust Specter Deploys SPLITDROP and GHOSTFORM Against Iraqi Officials

In the evolving landscape of geopolitical cyber-espionage, state-sponsored actors continue to refine their toolsets to bypass legacy defenses. Security Arsenal analysts have been tracking a concerning trend emerging from the Middle East, specifically targeting critical government infrastructure in Iraq. A new threat cluster, tracked by Zscaler ThreatLabz as Dust Specter, has been attributed to a suspected Iran-nexus actor orchestrating a sophisticated campaign against Iraqi officials.

This campaign is notable not just for its high-value targets, but for the introduction of two previously unknown malware families: SPLITDROP and GHOSTFORM. By impersonating the Iraqi Ministry of Foreign Affairs, the operators are leveraging social engineering to deliver these payloads, signaling a deliberate escalation in cyber-operational capabilities within the region.

The Attack Vector: A Masquerade of Diplomacy

The initial access vector relies heavily on the trust placed in governmental institutions. The threat actors distribute phishing emails that meticulously mimic official communications from the Iraqi Ministry of Foreign Affairs. These lures are designed to prompt the recipient into opening malicious attachments or clicking links under the guise of urgent diplomatic correspondence.

Once the victim interacts with the lure, the infection chain begins. The actors utilize SPLITDROP, likely a dropper or downloader mechanism engineered to establish a foothold on the system while evading initial detection. This precursor paves the way for GHOSTFORM, a more complex payload presumably used for data exfiltration, surveillance, or establishing persistence within the victim's network.

Deep Dive: SPLITDROP and GHOSTFORM

While the full technical analysis of these novel families is still developing, the naming conventions and observed behavior suggest specific functionalities:

• SPLITDROP: This component appears to act as the initial intrusion vehicle. Its nomenclature suggests a function involving 'splitting' files or processes to bypass heuristic analysis. It likely handles the decryption and loading of the second-stage payload, obfuscating its activity to look like legitimate system traffic or processes.
• GHOSTFORM: This secondary payload implies a focus on stealth and data harvesting. 'Form' suggests an interest in input, data forms, or potentially web injections, while 'Ghost' indicates capabilities for hiding its presence on the host. In the context of espionage, GHOSTFORM is likely the primary tool for intelligence gathering, capable of logging keystrokes, extracting documents, or capturing credentials.

Detection and Threat Hunting

To identify potential compromises related to Dust Specter, security teams should look for anomalies in process creation and file system activity. Given the use of spear-phishing, monitoring for child processes spawned by Office applications is critical.

KQL Query for Sentinel/Defender Detect suspicious child processes spawned by common Office applications that may indicate macro-based dropper activity.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in (~"winword.exe", ~"excel.exe", ~"powerpnt.exe", ~"outlook.exe")
| where ProcessCommandLine contains "-enc" or ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "IEX"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc


**PowerShell Script for Artifact Scanning**

Use this script to scan for recently created files in common drop directories that match the timeframe of a suspected intrusion.

$DateThreshold = (Get-Date).AddDays(-7)
$Paths = @("$env:APPDATA\Temp", "$env:LOCALAPPDATA\Temp", "$env:TEMP")

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $DateThreshold -and $_.Length -gt 0kb -and $_.Extension -match '\.(exe|dll|vbs|js|ps1)$' } |
        Select-Object FullName, LastWriteTime, Length, @{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}} |
        Format-Table -AutoSize
    }
}

Mitigation Strategies

Defending against targeted espionage requires a layered defense-in-depth approach:

1. Email Gateway Hardening: Implement strict DMARC, DKIM, and SPF policies to reduce the success of domain impersonation attacks. Use advanced threat protection to sandbox attachments originating from external entities.
2. Macro Reduction: Disable macros from the internet by default via Group Policy. This remains one of the most effective ways to stop droppers like SPLITDROP from executing.
3. Application Control: Utilize AppLocker or Windows Defender Application Control (WDAC) to restrict which applications are allowed to run on endpoints, preventing unauthorized executables from launching from user-writable directories.
4. User Education: Conduct targeted awareness training for high-profile personnel regarding the specific tactics used in these campaigns, such as scrutinizing the sender's actual email address versus the display name.

Conclusion

The emergence of Dust Specter highlights the continuous innovation by state-sponsored actors to develop custom malware for intelligence gathering. As SPLITDROP and GHOSTFORM evolve, organizations in the crosshairs of geopolitical tensions must maintain proactive threat hunting capabilities.

Security Arsenal remains vigilant in monitoring these developments. Our SOC is continuously updating detection rules to identify the TTPs associated with this actor.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub