Hunt Intelligence Reports Oman Ministry Intrusion and Theft of 26,000 Records
Summary
Hunt Intelligence reports an intrusion into Oman’s Ministry of Justice, with more than 26,000 user records and sensitive judicial data exfiltrated. A custom webshell was found; attribution to Iranian-linked actors remains inconclusive.
Key points
- Hunt Intelligence says an exposed UAE staging server revealed an intrusion targeting Oman’s Ministry of Justice and Legal Affairs.
- The report says attackers exfiltrated more than 26,000 user records and sensitive judicial and internal legal data.
- A custom webshell on mersaltest[.]mjla[.]gov[.]om allegedly provided persistent access; operator sessions were logged as recently as April 10, 2026.
- The exposed materials reportedly included attacker tools, command-and-control code, session logs, and SAM and SYSTEM registry hives.
- Hunt Intelligence did not make a definitive group attribution, but reported TTP overlap with APT34 (OilRig) and MuddyWater.
- The article links nearby infrastructure to Iranian diaspora media and Psiphon hosting, but presents this as contextual evidence rather than proof of attribution.
Article Details
- Victim Organization
- Ministry of Justice and Legal Affairs of Oman
- Victim Domain
- mersaltest.mjla.gov.om
- Incident Type
- Cyberespionage intrusion involving persistent access through a custom webshell and exfiltration of data
- Data Types Exposed
- Ministry of Justice user records
- Judicial case data
- Committee decisions
- Internal legal records
- SAM and SYSTEM registry hives
- Affected Records
- Over 26,000 Ministry of Justice user records
- Affected Data Size
- Not disclosed
- Operational Impact
- The attackers used a custom webshell on a test server to maintain access to the ministry's internal network. Operator sessions were active as recently as 2026-04-10.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Threat Actors
MuddyWaterHunt Intelligence reported that the campaign's TTPs overlap with MuddyWater; the article does not make a definitive group-level attribution.OilRigThe article explicitly identifies OilRig as another name for APT34 and reports TTP overlap with the campaign, without making a definitive group-level attribution.SOLAR IONHunt Intelligence reported that the campaign's TTPs overlap with APT34; the article does not make a definitive group-level attribution.
Vendors
Countries
IranThis cluster also hosted Psiphon—a censorship circumvention tool frequently used in Iran during periods of internet shutdowns.Omanuncovered an exposed staging server in the UAE that revealed a large intrusion campaign against Oman’s Ministry of Justice and Legal Affairs, including attacker tools, C2 code, session logs, and stolen data.United Arab EmiratesAn open directory on a VPS in the United Arab Emirates has exposed an active, large-scale intrusion campaign targeting the Omani government.