CampaignPublished 3 Sep 2025

Malicious Campaign Targeting Diplomatic Assets

Source AlienVault OTX General

Description

An Iranian-aligned spear-phishing campaign masquerading as Omani Ministry of Foreign Affairs communications targeted global government entities. The operation used compromised mailboxes to distribute malicious Word documents containing VBA macros. When executed, these macros decoded and deployed a payload named sysProcUpdate, which gathered system metadata and attempted to beacon to a command and control server. The campaign showed sophisticated techniques including anti-analysis measures, persistence mechanisms, and regional targeting across multiple countries. Evidence suggests this was part of a broader espionage effort by the Homeland Justice group associated with Iran's Ministry of Intelligence and Security, coinciding with heightened geopolitical tensions.

Impact

For European organizations, particularly government and diplomatic entities, this campaign poses a significant espionage risk. Successful compromise could lead to unauthorized disclosure of sensitive diplomatic communications, internal government strategies, and classified information, undermining national security and diplomatic relations. The persistence and anti-analysis capabilities of the malware increase the difficulty of detection and removal, potentially allowing long-term access to compromised networks. The use of spear-phishing and compromised legitimate mailboxes increases the attack's success probability, especially in environments where email security controls are not fully hardened. The campaign's targeting of multiple European countries indicates a broad interest in European diplomatic activities, which could result in intelligence gathering that affects policy decisions, international negotiations, and security postures. Additionally, the campaign could be a precursor to further disruptive or destructive operations if initial espionage objectives are met.

Defensive guidance

1. Implement advanced email filtering solutions that incorporate reputation-based and heuristic analysis to detect spear-phishing attempts, especially those impersonating trusted government entities. 2. Enforce strict macro policies in Microsoft Office applications, such as disabling macros by default and only allowing macros signed by trusted publishers. 3. Conduct targeted user awareness training focused on recognizing spear-phishing emails, especially those that appear to come from diplomatic or governmental sources. 4. Monitor network traffic for unusual outbound connections, particularly to suspicious domains like 'screenai.online', and implement DNS filtering to block known malicious domains. 5. Deploy endpoint detection and response (EDR) solutions capable of detecting process injection, persistence mechanisms, and other advanced malware behaviors. 6. Regularly audit and secure email infrastructure to prevent mailbox compromise, including enforcing multi-factor authentication (MFA) and monitoring for anomalous mailbox activity. 7. Establish incident response playbooks specifically for spear-phishing and espionage-related intrusions, including rapid containment and forensic analysis. 8. Collaborate with national cybersecurity agencies and international partners to share threat intelligence and indicators of compromise for timely detection and response.

Indicators of compromise

Domains 1

screenai.online

Hashes 14

010375357db9327f9fe40d184f078c6b
05d8f686dcbb6078f91f49af779e4572
1d02fc206b89fedd6dd0df0e8d40c4c5
20e7b9dcf954660555d511a64a07996f
2c92c7bf2d6574f9240032ec6adee738
2d57fcbc6a4695799aec15af4fa0a122
394d12a01a9cef4ac279135e4c1c67a9
3ac8283916547c50501eed8e7c3a77f0
3d6f69cc0330b302ddf4701bbc956b8f
6178f5819f8501611a521e19fbba74b0

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Sep 2025, 20:18 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 14

Community reviews

Related threats