Iran-Nexus Hackers Impersonate Omani MFA to Target Governments Entities

Cybersecurity researchers have linked a sophisticated Iran-linked spear-phishing operation to the impersonation of an Omani MFA in Paris, using hijacked diplomatic communications to target government entities worldwide. According to the report, the campaign involved 270 spear-phishing emails sent from 104 unique Omani MFA addresses, steering recipients to enable content in malicious Word documents and delivering a macro dropper.

The attackers allegedly relied on a four-stage macro chain, including a numeric-encoded payload and deliberate delays to defeat sandboxing, with the dropped executable named sysProcUpdate used to harvest host data and reach a command-and-control server at screenai[.]online. The operation is described as targeting six global regions, with Europe and African missions among those heavily affected, and it utilised NordVPN exit nodes in Jordan to obscure origins.

Analysts attribute the activity to the “Homeland Justice” group, believed to be aligned with Iran’s MOIS, though this label is presented as a claim. The campaign highlights ongoing regional espionage amid heightened geopolitical tensions and underscores the need for macro security policies and vigilant email filtering.