Ministry of Justice and Legal Affairs of Oman hit by network compromise
Incident
Summary
Hide ▲
Show ▼
The Ministry of Justice and Legal Affairs of Oman suffered an active intrusion that exposed session logs and more than 26,000 user records, raising risk to judicial and registry data. An open directory on 172.86.76[.]127 contained live compromise artifacts, including a toolkit and C2 code. The exposed material included judicial case data, committee decisions, and SAM and SYSTEM registry hives.
Related Happenings
Sefirah infostealer delivered through a malicious Hugging Face repository
Malware Activity
H score16
First: 09.05.2026 17:26
Last: 09.05.2026 17:26
Sources 1
About this happening:
A malicious Hugging Face repository impersonated OpenAI’s Privacy Filter and delivered sefirah, a Rust-based infostealer, to Windows users, creating credential...
Sefirah infostealer delivered through a malicious Hugging Face repository
Malware ActivityAbout this happening: A malicious Hugging Face repository impersonated OpenAI’s Privacy Filter and delivered sefirah, a Rust-based infostealer, to Windows users, creating credential...
MuddyWater Microsoft Teams social-engineering campaign with Chaos ransomware decoy
Campaign
H score37
First: 06.05.2026 16:02
Last: 06.05.2026 16:02
Sources 1
About this happening:
The MuddyWater campaign used Microsoft Teams social engineering and a Chaos ransomware decoy to gain access, steal credentials, and establish persistence. The operatio...
MuddyWater Microsoft Teams social-engineering campaign with Chaos ransomware decoy
CampaignAbout this happening: The MuddyWater campaign used Microsoft Teams social engineering and a Chaos ransomware decoy to gain access, steal credentials, and establish persistence. The operatio...
Storm-1175 high-tempo Medusa ransomware campaign
Campaign
H score59
First: 07.04.2026 13:02
Last: 07.04.2026 13:02
Sources 1
About this happening:
Storm-1175 is running a high-tempo Medusa ransomware campaign that has repeatedly exploited n-day and zero-day flaws to gain initial access before patching closes the...
Storm-1175 high-tempo Medusa ransomware campaign
CampaignAbout this happening: Storm-1175 is running a high-tempo Medusa ransomware campaign that has repeatedly exploited n-day and zero-day flaws to gain initial access before patching closes the...
CL-UNK-1068 years-long espionage campaign targeting Asian organizations
Campaign
H score38
First: 09.03.2026 09:21
Last: 09.03.2026 09:21
Sources 1
About this happening:
A Chinese threat actor is linked to a years-long espionage campaign against high-value organizations in South, Southeast, and East Asia, creating persistent risk for c...
CL-UNK-1068 years-long espionage campaign targeting Asian organizations
CampaignAbout this happening: A Chinese threat actor is linked to a years-long espionage campaign against high-value organizations in South, Southeast, and East Asia, creating persistent risk for c...
Velvet Tempest ClickFix malvertising campaign
Campaign
H score26
First: 07.03.2026 18:14
Last: 07.03.2026 18:14
Sources 1
About this happening:
Velvet Tempest ran a malvertising-driven ClickFix operation that used obfuscated Windows commands to gain access and stage payloads, making the intrusion chain more ef...
Velvet Tempest ClickFix malvertising campaign
CampaignAbout this happening: Velvet Tempest ran a malvertising-driven ClickFix operation that used obfuscated Windows commands to gain access and stage payloads, making the intrusion chain more ef...
Timeline
-
06.05.2026 16:00 2 articles · 2mo ago
Omani justice ministry intrusion campaign exposed
Initial DisclosureHunt.io exposed an active intrusion campaign against the Ministry of Justice and Legal Affairs of Oman after finding an open directory on 172.86.76[.]127, a RouterHosting VPS in the United Arab Emirates, with toolkit files, C2 code, session logs, and exfiltrated data left in plain sight. The exposed material linked the compromise to more than 26,000 Ministry of Justice user records plus judicial case data, committee decisions, and SAM and SYSTEM registry hives.
Show sources
- MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack — thehackernews.com — 06.05.2026 16:00
- MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack — thehackernews.com — 06.05.2026 16:00