Iranian-Nexus Cyberespionage Against Oman Government

A major cyberespionage campaign attributed to Iranian-nexus threat actors has compromised at least 12 government ministries in Oman, with the Ministry of Justice and Legal Affairs (MJLA) serving as a primary target. The operation, characterized by the exposure of an open C2 directory, resulted in the theft of over 26,000 citizen records, judicial case data, and sensitive system registry hives. Evidence suggests the actors utilized a custom Python-based C2 framework and a suite of over 50 scripts targeting various platforms.

The attack chain involved exploiting known vulnerabilities, such as ProxyShell (CVE-2021-34473) and a DotNetNuke SSRF flaw (CVE-2025-32372), to deploy custom webshells like 'hc2.aspx' and 'health_check_t.aspx'. Once inside, the operators performed methodical database enumeration and credential harvesting, specifically targeting national identity records and administrative accounts. Infrastructure analysis revealed a 'dubai-#' cluster of VPS servers, some of which hosted spoofed Iranian diaspora media, further aligning the activity with Iranian state-sponsored interests.

This campaign underscores the persistent threat posed by regional adversaries to Middle Eastern government infrastructure. The loss of judicial and identity data presents a significant long-term risk to Omani national security and citizen privacy. Organizations in the region should immediately audit for DotNetNuke and Exchange vulnerabilities and monitor for the specific lateral movement and persistence techniques identified in this report.