Iranian Threat Actors Breach 12 Omani Ministries, Exposing 26,000 Records

An active cyberattack compromised multiple Omani government networks, exposing internal systems and extracting sensitive data. The attackers accidentally left their digital staging server open to the public, allowing security researchers to directly observe their tools, session logs, and the stolen files in plain sight.

While a specific group is not definitively named, the tactics, infrastructure, and targets strongly align with Iranian state-sponsored threat actors. The behaviors observed heavily overlap with groups known for Middle Eastern cyberespionage, such as APT34 and MuddyWater.

The attack was a highly targeted cyberespionage campaign designed to infiltrate government networks and quietly extract highly sensitive citizen and judicial records. The operators focused on gathering intelligence and maintaining long-term, hidden access to these government systems.

The attackers cast a wide net, targeting at least 12 distinct Omani ministry offices. Compromised systems included the Ministry of Justice and Legal Affairs, the Royal Oman Police, and the Tax Authority of Oman.

Yes, the primary targets were government institutions, specifically databases holding judicial records, committee decisions, and national identity data. Over 26,000 Ministry of Justice user records, including national ID numbers, birthdates, and full names in both Arabic and English, were exposed.

The attackers gained entry by exploiting vulnerabilities in web applications and mail servers, as well as by guessing passwords. Once inside, they used specialized tools to elevate their access, hide their tracks, systematically steal databases, and communicate with the infected systems via a remote server.

Government ministries hold vast amounts of centralized intelligence, including legal, financial, and personal citizen data. Access to this highly sensitive information provides a strategic advantage for foreign espionage, political leverage, and the ability to track specific individuals.

Organizations should immediately apply security updates to all public-facing web applications and email servers. Additionally, they must monitor their networks for unusual access patterns, enforce multi-factor authentication across all user accounts, and ensure sensitive databases are strictly monitored for unauthorized access.