Omani Government Targeted in Blatant Iranian-Nexus Cyberespionage

Hunt Intelligence found an unprotected VPS in the UAE exposing an active intrusion campaign targeting Oman’s Ministry of Justice and Legal Affairs: attackers deployed a custom webshell (mersaltest.mjla.gov.om), maintained C2 access with operator sessions as recently as April 10, 2026, and exfiltrated over 26,000 Ministry user records plus judicial case data and SAM/SYSTEM registry hives; the infrastructure and TTPs overlap with Iranian state-nexus actors (notably APT34/MuddyWater) and were hosted on RouterHosting alongside related diaspora media and censorship-circumvention tooling.