{
  "name": "Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed",
  "slug": "iranian-nexus-operation-against-omans-government-12-ministries-hit-and-26000-citizen-records-exposed",
  "description": "An exposed command and control server on RouterHosting infrastructure revealed an active Iranian-nexus intrusion campaign targeting twelve Omani government ministries. The operation primarily focused on the Ministry of Justice and Legal Affairs, deploying custom webshells that provided persistent access through April 2026. Over 26,000 user records containing judicial case data, committee decisions, and registry hives were exfiltrated. The attacker utilized ProxyShell exploits, DotNetNuke vulnerabilities, and custom Python scripts targeting Exchange servers, SQL databases, and Oracle systems. Infrastructure analysis revealed connections to spoofed Iranian diaspora media and censorship circumvention tools, with tactical overlaps indicating MOIS-linked groups such as APT34 and MuddyWater. The campaign specifically targeted judicial records, immigration systems, and citizen identity data across multiple government entities.",
  "published": "2026-05-05T19:00:47.456000+00:00",
  "created_at": "2026-05-06T10:40:34.254000+00:00",
  "modified_at": "2026-05-06T08:40:34+00:00",
  "created_at_opencti": "2026-05-06T10:40:34.254000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "apt34",
    "dotnetnuke",
    "iranian-nexus",
    "proxyshell"
  ],
  "tags": [
    "2026-05-05",
    "apt34",
    "dotnetnuke",
    "iranian-nexus",
    "proxyshell"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "ca2e9d59-133a-4f78-adfc-7faccda767da",
        "name": "dubai-3.vaermb.com"
      },
      {
        "id": "6952c6bb-b21d-49c1-ac10-5307a9cc73de",
        "name": "vaermb.com"
      },
      {
        "id": "d76f238e-487a-4377-af04-2954ae3baa8a",
        "name": "dubai-7.vaermb.com"
      },
      {
        "id": "89f8bae9-347d-4c35-9b49-bda7bc22f3d2",
        "name": "regorixa.com"
      },
      {
        "id": "5980f6e6-f9f6-4afb-8dad-d62ff6b029c9",
        "name": "dubai-4.vaermb.com"
      },
      {
        "id": "b1d2b8e6-84cc-45ff-a3e0-7ce92597c24c",
        "name": "dubai-2.vaermb.com"
      },
      {
        "id": "915bc1ff-e144-4ec1-ab7d-617b9c27720f",
        "name": "brttfrixx.com"
      },
      {
        "id": "d3f95968-4ee9-4b75-b589-ddd4310c132b",
        "name": "brnettlix.com"
      },
      {
        "id": "a194be8e-ed96-4f09-8e26-4c6f60b2e67a",
        "name": "dubai-9.vaermb.com"
      },
      {
        "id": "a1c092d0-e038-478d-b9e6-76a1ae8f2693",
        "name": "mail.rfo.gov.om"
      },
      {
        "id": "db185cfa-5f7b-4390-a523-59d90716c0a4",
        "name": "shop.exceptionnotfound.ir"
      },
      {
        "id": "004545de-5304-414a-9250-6b27def2e6be",
        "name": "dubai-10.vaermb.com"
      },
      {
        "id": "bdd41536-d5f8-4a0a-9c1f-18efe6933962",
        "name": "mjla.gov.om"
      },
      {
        "id": "38b2dcd6-a964-493d-86ca-b3270b61e4aa",
        "name": "dubai-6.vaermb.com"
      },
      {
        "id": "473768ca-7939-4af1-8a6b-c81cb04546da",
        "name": "mersaltest.mjla.gov.om"
      },
      {
        "id": "9378fa38-a731-4975-b7a4-7bdf5a5a5562",
        "name": "price.exceptionnotfound.ir"
      },
      {
        "id": "61d2946c-6108-49b6-a502-a768d8ed1576",
        "name": "ecc3611f7dcbaa53acf44e67de2f10d78a26e03b3c77ba28bbd3ee16b2e66437"
      },
      {
        "id": "2ca9a97f-bb5a-4e5d-9f19-78dc6e30469d",
        "name": "dubai-5.vaermb.com"
      },
      {
        "id": "e2fe6058-c1d0-4a95-b7d9-af6ad1159e67",
        "name": "tools.exceptionnotfound.ir"
      },
      {
        "id": "1f03e969-91e4-491f-b044-4a1957ed6bf4",
        "name": "sailms.gov.om"
      },
      {
        "id": "55738fbe-23e0-4caf-9e7b-a0d255b0d11b",
        "name": "suanefllix.com"
      },
      {
        "id": "9138a0c2-37b4-4a67-95ee-a4114f9108ed",
        "name": "dubai-1.vaermb.com"
      },
      {
        "id": "e2aa0a5e-07f2-4e0c-9b4f-efc97879fa07",
        "name": "email.taxoman.gov.om"
      },
      {
        "id": "d55e0931-c981-4e5e-85b6-dd836fac09b2",
        "name": "myjitsi.exceptionnotfound.ir"
      },
      {
        "id": "358da421-8026-43d1-bd74-a8eed685b168",
        "name": "realprimefix.com"
      },
      {
        "id": "c51a72ab-aef7-4492-957d-b029ce67db46",
        "name": "s5.sideliner.ir"
      },
      {
        "id": "bcbed7de-def6-4d8f-bad5-38fa18590ad6",
        "name": "myjitsi.mrnajafipour.ir"
      },
      {
        "id": "aedaa2af-2773-4172-870a-d94c7edad011",
        "name": "dubai-8.vaermb.com"
      },
      {
        "id": "86779b4b-44bf-4d0c-9a39-74b45e42876e",
        "name": "identificara.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "52279b3d-8158-4964-8c20-9094308fcd03",
        "name": "T1110.001"
      },
      {
        "id": "9e6c4b38-f4e1-4b1f-b90a-222f881acbab",
        "name": "T1087.002"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "adac40c7-ef36-4a03-af99-079bc834463a",
        "name": "T1003.002"
      },
      {
        "id": "d048ac4b-dd28-4c66-b62b-fe25cefef481",
        "name": "T1548.002"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "763d03e0-25af-44e4-a6ad-7e5dcd86ff5a",
        "name": "T1074.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "a2ba5594-6293-4868-928c-ab4b31927a02",
        "name": "T1572"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "41ad5d62-aa6a-47d6-a9a9-fb2209601099",
        "name": "T1098"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "eee86897-6bfb-40f1-b68c-9e79f593b70f",
        "name": "Chisel",
        "slug": "chisel"
      },
      {
        "id": "2fe3bea4-781c-44b1-ac41-531511d6d8db",
        "name": "GodPotato",
        "slug": "godpotato"
      }
    ],
    "observables": [
      {
        "id": "7ab7327c-24b6-4b81-b269-241f7b3e1935",
        "name": "mjla.gov.om"
      },
      {
        "id": "85bd5baa-3434-4a62-a157-0e9e8d74351e",
        "name": "brnettlix.com"
      },
      {
        "id": "46b82d0c-884d-482b-9ad5-7a8fc5f8546a",
        "name": "regorixa.com"
      },
      {
        "id": "a98f9afc-64da-421c-b978-71d60ed4f2fe",
        "name": "sailms.gov.om"
      },
      {
        "id": "16859c15-88b7-441f-8bb3-9a9c3a5f541b",
        "name": "brttfrixx.com"
      },
      {
        "id": "25597f2b-c35b-42c2-8d42-b9ba306a5dbe",
        "name": "suanefllix.com"
      },
      {
        "id": "6a9f216f-2f23-4da1-b559-46d500c82948",
        "name": "realprimefix.com"
      },
      {
        "id": "6948ce58-405b-434b-ba9d-09507d4ddc5c",
        "name": "identificara.com"
      },
      {
        "id": "2eb716b9-1e8c-43f6-b356-1e4101b6f178",
        "name": "vaermb.com"
      },
      {
        "id": "601b839d-d6f4-4310-bf80-9dc9bf4e83fc",
        "name": "myjitsi.mrnajafipour.ir"
      },
      {
        "id": "6c2384b2-52eb-4140-8cb0-d5ed6a25b924",
        "name": "shop.exceptionnotfound.ir"
      },
      {
        "id": "8528907b-4662-4f0b-acc0-6d962f709910",
        "name": "s5.sideliner.ir"
      },
      {
        "id": "96a370ae-3f5a-4bb3-a4aa-832c30c1ed73",
        "name": "price.exceptionnotfound.ir"
      },
      {
        "id": "dd4c3e7a-b669-4e8e-af8b-f9961aeeec81",
        "name": "dubai-3.vaermb.com"
      },
      {
        "id": "ad748cb5-db82-4352-abe7-9b275ffd7747",
        "name": "dubai-7.vaermb.com"
      },
      {
        "id": "0fab7360-791f-46d9-82d5-eb699174e96e",
        "name": "tools.exceptionnotfound.ir"
      },
      {
        "id": "4cbec52a-7929-4e6d-b3ff-e84a9eb42c54",
        "name": "mail.rfo.gov.om"
      },
      {
        "id": "282fe329-3375-4140-8dc8-652653fa50bc",
        "name": "dubai-6.vaermb.com"
      },
      {
        "id": "3e56fbf9-ae6d-4653-8cfe-149d7260e8fd",
        "name": "dubai-5.vaermb.com"
      },
      {
        "id": "46a0b55e-fdcd-4d41-8f16-e09aed4f54ff",
        "name": "dubai-9.vaermb.com"
      },
      {
        "id": "4308d252-6d77-4cbf-9580-f9db6acceacb",
        "name": "dubai-1.vaermb.com"
      },
      {
        "id": "99ac49a5-1311-4149-a5fc-20c939aa35e4",
        "name": "dubai-10.vaermb.com"
      },
      {
        "id": "8c76e2cb-7042-4d76-838e-0d9ede6b284b",
        "name": "myjitsi.exceptionnotfound.ir"
      },
      {
        "id": "a66d2c91-0bfc-4dfa-ad40-99e9c40138f1",
        "name": "email.taxoman.gov.om"
      },
      {
        "id": "983acbe7-383f-467b-ac05-469a9b8ab717",
        "name": "dubai-2.vaermb.com"
      },
      {
        "id": "6c72233e-f7fc-47b7-ac21-9c0007ec6a13",
        "name": "dubai-8.vaermb.com"
      },
      {
        "id": "eeb8b96e-22f7-478d-a2cc-065a1759c7ad",
        "name": "mersaltest.mjla.gov.om"
      },
      {
        "id": "fdc42268-82e5-4446-ac2d-3affda89c010",
        "name": "dubai-4.vaermb.com"
      },
      {
        "id": "",
        "name": "ecc3611f7dcbaa53acf44e67de2f10d78a26e03b3c77ba28bbd3ee16b2e66437"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "dubai-3.vaermb.com"
      },
      {
        "id": "",
        "name": "vaermb.com"
      },
      {
        "id": "",
        "name": "dubai-7.vaermb.com"
      },
      {
        "id": "",
        "name": "regorixa.com"
      },
      {
        "id": "",
        "name": "dubai-4.vaermb.com"
      },
      {
        "id": "",
        "name": "dubai-2.vaermb.com"
      },
      {
        "id": "",
        "name": "brttfrixx.com"
      },
      {
        "id": "",
        "name": "brnettlix.com"
      },
      {
        "id": "",
        "name": "dubai-9.vaermb.com"
      },
      {
        "id": "",
        "name": "mail.rfo.gov.om"
      },
      {
        "id": "",
        "name": "shop.exceptionnotfound.ir"
      },
      {
        "id": "",
        "name": "dubai-10.vaermb.com"
      },
      {
        "id": "",
        "name": "mjla.gov.om"
      },
      {
        "id": "",
        "name": "dubai-6.vaermb.com"
      },
      {
        "id": "",
        "name": "mersaltest.mjla.gov.om"
      },
      {
        "id": "",
        "name": "price.exceptionnotfound.ir"
      },
      {
        "id": "",
        "name": "dubai-5.vaermb.com"
      },
      {
        "id": "",
        "name": "tools.exceptionnotfound.ir"
      },
      {
        "id": "",
        "name": "sailms.gov.om"
      },
      {
        "id": "",
        "name": "suanefllix.com"
      },
      {
        "id": "",
        "name": "dubai-1.vaermb.com"
      },
      {
        "id": "",
        "name": "email.taxoman.gov.om"
      },
      {
        "id": "",
        "name": "myjitsi.exceptionnotfound.ir"
      },
      {
        "id": "",
        "name": "realprimefix.com"
      },
      {
        "id": "",
        "name": "s5.sideliner.ir"
      },
      {
        "id": "",
        "name": "myjitsi.mrnajafipour.ir"
      },
      {
        "id": "",
        "name": "dubai-8.vaermb.com"
      },
      {
        "id": "",
        "name": "identificara.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "4121bec4-1339-460f-9ece-34b4fe5a7682",
      "standard_id": "external-reference--a5996247-2743-570a-9f3b-5d99bc475e6f",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69fa3e5f84a20294f972fa64",
      "hash": null,
      "external_id": "69fa3e5f84a20294f972fa64",
      "created": "2026-05-06T10:40:31.551Z",
      "modified": "2026-05-06T10:40:31.551Z",
      "createdById": null
    },
    {
      "id": "433e47b0-8099-4bd7-93da-e9911b08327c",
      "standard_id": "external-reference--c20a38f0-a33c-5c94-91d4-1e369f674aa8",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://hunt.io/blog/iranian-nexus-oman-government-intrusion",
      "hash": null,
      "external_id": null,
      "created": "2026-05-06T10:40:31.578Z",
      "modified": "2026-05-06T10:40:31.578Z",
      "createdById": null
    }
  ]
}