Homeland Justice Phishing Operation Hits Diplomatic and Government Sectors Globally

A cyber espionage campaign used a compromised Omani Ministry of Foreign Affairs email account to send malicious emails to governments and organizations worldwide. These emails carried malware disguised as official documents.

The operation has been attributed to Iranian-aligned hackers linked to the Homeland Justice group, which is associated with Iran’s Ministry of Intelligence and Security.

The attackers sought to gather intelligence from diplomatic and government targets. The malware collected system information and connected to a control server, likely as part of a larger spying operation.

Entities in over 40 countries were targeted, including embassies, consulates, ministries, and international organizations such as the UN and UNICEF. Europe and Africa were most heavily targeted.

Victims received emails that looked like legitimate MFA messages. When they opened the attached Word documents and enabled macros, hidden code installed spyware on their systems without their knowledge.

Government and diplomatic institutions hold sensitive geopolitical information. The timing suggests the attackers were interested in influencing or monitoring regional diplomatic negotiations.

Organizations should block macro-enabled documents by default, educate staff on phishing risks, monitor network traffic for suspicious activity, and use endpoint security tools to detect and respond to threats.