Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An Iranian-aligned spear-phishing campaign masquerading as Omani Ministry of Foreign Affairs communications targeted global government entities. The operation used compromised mailboxes to distribute malicious Word documents containing VBA macros. When executed, these macros decoded and deployed a payload named sysProcUpdate, which gathered system metadata and attempted to beacon to a command and control server. The campaign showed sophisticated techniques including anti-analysis measures, persistence mechanisms, and regional targeting across multiple countries. Evidence suggests this was part of a broader espionage effort by the Homeland Justice group associated with Iran's Ministry of Intelligence and Security, coinciding with heightened geopolitical tensions.

This threat describes a sophisticated spear-phishing campaign attributed to an Iranian-aligned threat actor group known as Homeland Justice, linked to Iran's Ministry of Intelligence and Security. The campaign impersonates communications from the Omani Ministry of Foreign Affairs to target global government entities, with a particular focus on diplomatic assets. The attack vector involves the use of compromised legitimate mailboxes to distribute malicious Microsoft Word documents embedded with VBA macros. Upon execution, these macros decode and deploy a payload named sysProcUpdate. This payload is designed to collect detailed system metadata and establish communication with a command and control (C2) server, enabling ongoing espionage activities. The campaign employs advanced techniques including anti-analysis measures to evade detection, persistence mechanisms to maintain foothold on infected systems, and regional targeting that spans multiple countries. The use of legitimate compromised mailboxes increases the likelihood of successful delivery and reduces suspicion. The campaign leverages multiple MITRE ATT&CK techniques such as spear-phishing attachments (T1566.001), execution through VBA macros (T1204.002), system information discovery (T1082), obfuscated files or information (T1027), process injection (T1055), and command and control over standard application layer protocols (T1571). Indicators of compromise include multiple file hashes and a suspicious domain (screenai.online) used for C2 communications. The campaign coincides with heightened geopolitical tensions, suggesting a strategic espionage motive targeting diplomatic communications and government operations.

Detailed information about Malicious Campaign Targeting Diplomatic Assets. Get real-time updates, technical details, and mitigation strategies.

Malicious Campaign Targeting Diplomatic Assets - Live Threat Intelligence - Threat Radar | OffSeq.com

Malicious Campaign Targeting Diplomatic Assets

An Iran-nexus spear-phishing campaign masquerading as the Omani Ministry of Foreign Affairs targeted global governments in August 2025. Attributed to Iranian-aligned operators linked to the Homeland Justice group and MOIS, the campaign used compromised mailboxes to send emails with malicious Microsoft Word attachments. The documents contained VBA macros that decoded and deployed malware payloads. The multi-wave operation targeted diplomatic and governmental entities across multiple regions, including the Middle East, Africa, Europe, Asia, and the Americas. The campaign utilized social engineering lures, anti-analysis techniques, and a reconnaissance-focused malware called sysProcUpdate. The attackers aimed to gain initial access, map internal networks, and prepare for further exploitation in diplomatic and industrial organizations.

This threat describes a sophisticated spear-phishing campaign attributed to Iranian-aligned threat actors linked to the Homeland Justice group and Iran's Ministry of Intelligence and Security (MOIS). The campaign, active in August 2025, impersonated the Omani Ministry of Foreign Affairs to target diplomatic and governmental entities worldwide, including Europe. Attackers leveraged compromised legitimate mailboxes to send malicious emails containing Microsoft Word documents with embedded VBA macros. When macros are enabled by the recipient, they decode and deploy a reconnaissance-focused malware named sysProcUpdate. This malware is designed to gather detailed information about the infected system and network environment, including internal network mapping and credential harvesting, to facilitate further exploitation. The campaign employed multiple waves and utilized social engineering lures tailored to diplomatic targets, anti-analysis techniques to evade detection, and a broad set of tactics, techniques, and procedures (TTPs) such as process injection, persistence mechanisms, credential dumping, and command and control communications. Indicators of compromise include multiple file hashes and a malicious domain (screenai.online). The operation's goal is initial access and reconnaissance within high-value diplomatic and industrial organizations, preparing for potential follow-on attacks or espionage activities.

Detailed information about CTI Analysis: Malicious Email Campaign. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'oman mfa'

Filter Threats

Threats Tagged 'oman mfa'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility