Beyond Phishing: Iranian-Aligned Group Abuses Omani Mailbox to Spy on Diplomats

According to Dream’s Threat Intelligence Team, a sophisticated spear‑phishing campaign used a compromised mailbox of the Ministry of Foreign Affairs of Oman to target diplomats and international organisations. The operation sent malicious emails that appeared to originate from the Omani MFA, routed via a NordVPN exit node in Jordan to mask the true origin.

Dream notes that 270 emails were analysed and 104 unique compromised addresses were leveraged to mask the activity’s true origin, indicating a broader, global ambition. The malware delivered via Word documents prompted users to enable macros, triggering a multi‑stage infection, with the decoded payload performing system reconnaissance and beaconing to a C2 server.

The campaign, attributed to Iranian‑aligned operators connected to Homeland Justice, involved regionalised targeting across Europe, Africa and beyond, including embassies in multiple countries and international organisations such as the UN, UNICEF and the World Bank. The malware, named sysProcUpdate, primarily collects system metadata and beacons to a C2 server, suggesting an espionage objective rather than financial crime.