Iran-Nexus Hackers Exploit Omani Mailbox to Target Governments

A sophisticated spear-phishing campaign exploited a compromised mailbox belonging to the Ministry of Foreign Affairs of Oman to target governments and diplomatic missions worldwide. The operation, claims to be conducted by an Iranian-aligned group known as Homeland Justice and linked to Iran’s Ministry of Intelligence and Security (MOIS), masqueraded as legitimate MFA communications to infiltrate multiple regions.

The campaign used the hijacked Omani MFA mailbox to dispatch malicious Microsoft Word attachments disguised as official registration forms, with a dropper placing a reconstructed executable named ManagerProc.log in the public documents folder and launching it invisibly via Windows Shell to beacon to a C2 domain at screenai[.]online.

Forensic analysis connected the tactics to earlier Homeland Justice operations, suggesting a regional espionage effort amid heightened Middle East tensions, with data from 270 spear-phishing emails revealed across 104 unique compromised addresses. The targeted reach spanned Africa, Europe, Asia, the Americas, International Organizations, and generic domains, aided by a NordVPN exit node in Jordan to mask origins and by a uniform payload approach.

The malware, dubbed sysProcUpdate, collected host metadata, encrypted it, and sent it to the C2 server, while the campaign’s VBA macro encoded numeric strings to reconstruct the payload. Researchers outline recommendations including blocking identified IOCs such as ManagerProc.log and screenai[.]online, disabling Office macros, auditing VPN and DNS settings, and enforcing network segmentation.