01 — Summary
What happened
An active Iranian-aligned cyber espionage operation targeted twelve Omani government ministries, with the Ministry of Justice and Legal Affairs (MJLA) as the primary victim. The campaign was uncovered after the threat actor inadvertently left an attacker-controlled staging VPS (172.86.76[.]127, resolving to dubai-10.vaermb[.]com, UAE-hosted) publicly exposed — revealing the complete operator toolkit, command-and-control source code, session logs, and exfiltrated victim data in plaintext. Operator sessions were observed between April 8–10, 2026.
Initial access against MJLA most likely came through CVE-2025-32372, an SSRF flaw in DotNetNuke versions prior to 9.13.8. Secondary vectors included the ProxyShell chain (CVE-2021-34473 / 34523 / 31207) against Microsoft Exchange servers. The operator deployed a custom ASPX webshell, a Python C2 with PowerShell beacon, Chisel for encrypted tunneling, and GodPotato for privilege escalation, ultimately exfiltrating over 26,000 MJLA user records, judicial case data, citizen IDs, and SAM/SYSTEM registry hives. No definitive group-level attribution has been made, though TTPs strongly overlap with MOIS-linked clusters APT34 (OilRig) and MuddyWater (Mango Sandstorm).
02 — Vulnerability details
Exploited CVEs
Four vulnerabilities were exploited or leveraged across this intrusion campaign. All have available patches — prioritise immediate remediation.
03 — Attack details
How the intrusion unfolded
The operation reflects a deliberate, intelligence-driven campaign against Omani government infrastructure, underpinned by opportunistic OPSEC failures that exposed the full operator toolkit to researchers.
The campaign was uncovered after the threat actor left their attacker-controlled staging VPS (172.86.76[.]127, resolving to dubai-10.vaermb[.]com, UAE-hosted) publicly accessible. The exposed server contained the complete operator toolkit, C2 source code, session logs, and exfiltrated victim data in plaintext. Operator sessions were logged between April 8–10, 2026. The targeting builds on a 2025 incident attributed to the Homeland Justice persona (Void Manticore), in which Oman's Ministry of Foreign Affairs mailbox in Paris was hijacked to spear-phish embassies worldwide.
The operation targeted twelve Omani government bodies: MJLA, Royal Oman Police, Royal Fleet of Oman, Tax Authority of Oman, State Audit Institution, Royal Court Affairs, Authority for Public Services Regulation, Civil Aviation Authority, Information Technology Authority, Ministry of Finance, MTCIT, and the Office of Public Prosecution. Initial access against MJLA most likely came through CVE-2025-32372, an SSRF flaw in DotNetNuke versions prior to 9.13.8. Secondary vectors included the ProxyShell chain (CVE-2021-34473 / 34523 / 31207) against Exchange servers — tradecraft previously associated with MuddyWater in regional intrusions — alongside credential brute-force attempts against the eVisa portal and the State Audit Institution training platform.
The operator deployed a custom ASPX webshell (hc2.aspx, health_check_t.aspx) through the DotNetNuke /Portals/0/ directory, providing persistent remote command execution. A host-level persistence attempt using a scheduled task named MicrosoftEdgeUpdate was blocked by Microsoft Defender. The operator then deployed a Python HTTP C2 paired with a PowerShell beacon polling every 30 seconds, returning base64-encoded results in 1,500-character chunks. Chisel was staged on port 7777 for encrypted tunneling. GodPotato — later replaced by a reflective in-memory variant — abused SeImpersonatePrivilege for local privilege escalation, tradecraft consistent with APT34's documented Gulf-targeted kernel-level operations.
On April 10, 2026 at 03:00 UTC, the operator exfiltrated over 26,000 MJLA user records — including staff emails and credentials — alongside judicial judgments, case session attachments, committee decisions, and queries against the eGov_Person table targeting national IDs, names, birthdates, and nationality data. SAM and SYSTEM registry hives were staged in C:\Windows\Temp for exfiltration via port 9002, effectively compromising all local-machine secrets and cached domain credentials in the MJLA environment.
No definitive group-level attribution has been made. However, TTPs strongly overlap with MOIS-linked clusters APT34 (OilRig) and MuddyWater (Mango Sandstorm). The activity continues a broader pattern of Iranian state-nexus targeting against GCC critical infrastructure, alongside the Handala destructive wiper campaign and MOIS-aligned dissident espionage operations targeting the region.
04 — Recommendations
What to do now
Six prioritised response actions for security and operations teams. Actions 4 and 5 are critical for any organisation sharing identity infrastructure with MJLA.
Apply Microsoft Exchange Server security updates addressing CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. Any internet-facing Exchange server that has not received the May 2021 cumulative update or later remains vulnerable to the full ProxyShell exploit chain demonstrated in this campaign.
Update all DotNetNuke (DNN) Platform instances to version 9.13.8 or newer to remediate CVE-2025-32372. Pay particular attention to ministry and government portals that expose DNN as a public-facing CMS, including those sharing identity-provider infrastructure such as SimpleSAMLphp federation.
Inspect the DotNetNuke /Portals/0/ directory for unauthorized ASPX files matching webshell patterns such as health_check_t.aspx or hc2.aspx. Restrict write permissions to the path and configure the IIS handler mapping so that arbitrary ASPX files placed in content directories cannot be served as executable script.
For MJLA and any organisation sharing federation with MJLA's SimpleSAMLphp identity provider, force-reset all DotNetNuke application accounts — with priority to superuser and aspnet_Membership-backed accounts — invalidate active sessions, and rotate any service-account passwords accessible from compromised hosts.
Because both SAM and SYSTEM registry hives were extracted from the MJLA environment, treat all local-machine secrets, cached domain credentials, and machine-account secrets as compromised. Reset them, force a krbtgt double-rotation if Active Directory was reachable, and audit Kerberos ticket lifetimes for anomalies.
Because ITA and MTCIT portals share the /ITAPortal_AR/ URL structure and likely a common codebase, and because MJLA's SimpleSAMLphp identity provider could federate authentication across ministries, segment ministry portals from one another, isolate the identity provider in a dedicated security zone, and apply per-ministry boundary controls so that a single portal compromise cannot pivot horizontally.
05 — Indicators of compromise
IoCs — Iranian-nexus Oman intrusion
Block or monitor all indicators below across network controls, endpoint detection, and SIEM pipelines. All domains and IPs are defanged.
- 172[.]86[.]76[.]127
- 172[.]86[.]76[.]101
- 172[.]86[.]76[.]94
- 172[.]86[.]76[.]108
- 172[.]86[.]76[.]112
- 172[.]86[.]76[.]120
- 172[.]86[.]76[.]121
- 172[.]86[.]76[.]124
- 172[.]86[.]76[.]129
- 172[.]86[.]76[.]130
- 45[.]59[.]114[.]60
- 104[.]21[.]27[.]95
- 172[.]67[.]142[.]35
- dubai-10.vaermb[.]com
- dubai-1.vaermb[.]com
- dubai-2.vaermb[.]com
- dubai-3.vaermb[.]com
- dubai-4.vaermb[.]com
- dubai-5.vaermb[.]com
- dubai-6.vaermb[.]com
- dubai-7.vaermb[.]com
- dubai-8.vaermb[.]com
- dubai-9.vaermb[.]com
- regorixa[.]com
- myjitsi.exceptionnotfound[.]ir
- shop.exceptionnotfound[.]ir
- price.exceptionnotfound[.]ir
- tools.exceptionnotfound[.]ir
- myjitsi.mrnajafipour[.]ir
- s5.sideliner[.]ir
- suanefllix[.]com
- brnettlix[.]com
- brttfrixx[.]com
- realprimefix[.]com
- identificara[.]com
- hc2.aspx
- health_check_t.aspx
- proxyshell_01.sh
- evisa_cookies.txt
- c2_fixed.py
- c2_fixed_v2.py
- c2_json_v2.py
- new_beacon.ps1
- gp_v6_exec.py
- /Portals/0/health_check_t.aspx
- /opt/c2/loot/
- /opt/c2/payloads/
- C:\Windows\Temp (registry hive staging)
- ECC3611F7DCBAA53ACF44E67DE2F10D78A26E03B3C77BA28BBD3EE16B2E66437
- 8001 — C2 beacon listener
- 7777 — Chisel host
- 9002 — Registry hive exfiltration
- 9003 — Reverse SOCKS5 listener
06 — MITRE ATT&CK TTPs
Tactics, techniques & sub-techniques
Full MITRE ATT&CK mapping for the Iranian-nexus Oman government intrusion campaign.
07 — Patch links & references
