CTI Analysis: Malicious Email Campaign

An Iran-nexus spear-phishing campaign masquerading as the Omani Ministry of Foreign Affairs targeted global governments in August 2025. Attributed to Iranian-aligned operators linked to the Homeland Justice group and MOIS, the campaign used compromised mailboxes to send emails with malicious Microsoft Word attachments. The documents contained VBA macros that decoded and deployed malware payloads. The multi-wave operation targeted diplomatic and governmental entities across multiple regions, including the Middle East, Africa, Europe, Asia, and the Americas. The campaign utilized social engineering lures, anti-analysis techniques, and a reconnaissance-focused malware called sysProcUpdate. The attackers aimed to gain initial access, map internal networks, and prepare for further exploitation in diplomatic and industrial organizations.

• 2CLoader: A New Malware Loader Delivering Vidar and RemusMalware2026-09-30
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Peeling Back the Layers: Inside Vidar · From Virtualized Code to Stolen CredentialsMalware2026-09-09
• Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weaponCampaign2026-09-02