Omani Email Server Exploited by Iran-Linked Hackers in Global Government Spy Campaign

In August 2025, a sophisticated spear-phishing operation leveraged a compromised mailbox of the Omani Ministry of Foreign Affairs (MFA) in Paris to target diplomatic and governmental entities worldwide.

Cybersecurity researchers attribute the campaign to Homeland Justice, an Iranian-aligned operator linked to the MOIS (Ministry of Intelligence and Security of Iran).

Using stolen credentials from the Oman MFA server, attackers dispatched malicious Microsoft Word documents disguised as urgent multi-factor authentication (MFA) notices to embassies, consulates, and international organizations across five regions.

Sophisticated Spear-Phishing Operation

From a dataset of 270 emails, the threat actors employed 104 unique sender addresses to mask the true origin of their outreach.

Recipients spanned the Middle East, Africa, Europe, Asia, and the Americas, along with key multilateral bodies such as the UN, UNICEF, and the World Bank.

Each email invoked urgency, “Enable Content for Secure Access,” and masqueraded as official diplomatic communications to compel macro activation.

Network forensics revealed that the phishing emails were routed through NordVPN exit nodes in Jordan (212.32.83.11), which obscured the infrastructure and complicated attribution.

The campaign’s timing coincided with sensitive ceasefire negotiations involving Hamas, underscoring the geopolitical motives driving the operation. By compromising a legitimate government server, attackers achieved higher deliverability and trust, effectively bypassing many traditional spam filters.

Advanced VBA-Based Malware Delivery

Analysis of the malicious Word attachments revealed dual VBA modules, ThisDocument and UserForm1, which craft a multi-stage dropper. The UserForm1 module stores an encoded payload as a sequence of three-digit numbers in a TextBox control.

The dddd function reads these triplets, converts them to ASCII via Chr(Val(…)), and reconstructs the binary executable.

To evade sandbox analysis, the laylay function introduces substantial delays through four nested loops of 105 iterations each.

When Document_Open fires, it defines an output path (C:\Users\Public\Documents\ManagerProc.log), decodes the payload, and writes it into what appears to be a harmless log file.

The RRRR function then hides execution using Shell with vbHide, ensuring invisible launch of sysProcUpdate.exe.

Once deployed, sysProcUpdate employs anti-analysis tactics, packing sections, and invoking SetUnhandledExceptionFilter to frustrate reverse engineering.

On execution, it gathers host metadata (username, computer name, administrative status) into a JSON structure, encrypts it, and beacons to its C2 at https://screenai.online/Home/ via HTTPS POST.

The malware establishes persistence by copying itself to C:\ProgramData\sysProcUpdate.exe and modifies DNS and TCP/IP registry parameters to manipulate network communications.

Recommendations

To mitigate similar threats, organizations should enforce strict macro policies, disabling macros by default and allowing only signed, trusted documents.

Security teams must monitor outbound POST requests to suspicious domains, audit registry changes in Dnscache\Parameters, and block IOCs, including screenai online and related document hashes.

Review VPN logs for anomalous exit-node patterns, particularly traffic via Jordan, and implement network segmentation with egress filtering to contain potential breaches.

This operation demonstrates a blend of legitimate infrastructure compromise, regional targeting, and advanced obfuscation, all hallmarks of state-sponsored espionage designed to harvest reconnaissance data and gain footholds within high-value diplomatic networks.

IOC

1. The IOC of screenai.online is a C2 domain used by the actor
2. The IOC of https://screenai.online/Home/ URL is the main C2 URL path (with dozens of sub paths found.
3. The IOC of b2c52fde1301a3624a9ceb995f2de4112d57fcbc6a4695799aec15af4fa0a122 is a document (DOC) named Online Seminar.FM.gov.om.dnr.doc.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates