Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed

hunt.io | blog | #threat-intelligence | #data-exposure | #espionage | #webshell | #iran-nexus | #oman

Summary

An exposed UAE-hosted VPS revealed an Iranian-nexus operation against Oman: a webshell on the Justice Ministry, 26,000+ citizen and judicial records stolen, and operator sessions into April 2026.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server
Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia
Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.
blog · hunt.io
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
An exposed Hong Kong staging server revealed Hermes, an autonomous AI agent run unattended, an unreported Go implant named Hades, and tooling targeting Thailand's Ministry of Finance.
blog · hunt.io
Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries
Suspected Chinese operators used Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand and Taiwan, and scanned 5,890+ government hosts worldwide.
back