This threat involves an active cyber espionage campaign attributed to Iranian-nexus actors targeting Omani government ministries. The attackers exploited known vulnerabilities including ProxyShell and DotNetNuke to gain persistent access via custom webshells. They deployed custom Python scripts to compromise Exchange servers, SQL databases, and Oracle systems, enabling exfiltration of over 26,000 sensitive records related to judicial cases, committee decisions, and citizen identity data. The campaign infrastructure shows ties to MOIS-linked groups such as APT34 and MuddyWater, with operational overlaps including use of censorship circumvention tools and spoofed media infrastructure. The campaign's persistence through April 2026 indicates a long-term targeted espionage effort against critical government sectors in Oman.

The campaign resulted in the exfiltration of over 26,000 sensitive records from twelve Omani government ministries, including judicial case data, committee decisions, and citizen identity information. Persistent access was maintained through April 2026, indicating prolonged exposure and potential for ongoing espionage or data manipulation. The compromise of multiple critical systems such as Exchange servers, SQL databases, and Oracle systems increases the risk of further data loss or operational disruption. The targeting of judicial and immigration systems could have significant implications for national security and citizen privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should prioritize identifying and remediating ProxyShell and DotNetNuke vulnerabilities in their environments. Monitoring for indicators of compromise related to custom webshells and unusual activity on Exchange, SQL, and Oracle systems is recommended. Given the attribution to known APT groups, enhanced threat detection and incident response readiness should be maintained. No cloud service remediation applies as this is on-premises infrastructure.