In August 2025, Oman’s Foreign Ministry fell victim to a sophisticated Iranian state-sponsored phishing campaign executed by the Homeland Justice group, linked to Iran’s Ministry of Intelligence and Security. The attack compromised the ministry’s email system, enabling hackers to send malicious Word documents disguised as diplomatic correspondence to ~200 high-profile recipients, including Egyptian officials in Cairo and Paris, as well as U.S. and Qatari mediators involved in Gaza ceasefire negotiations.The malware embedded in the documents deployed offensive cyber-espionage tools, allowing attackers to monitor targets, intercept emails, and record private conversations. While no direct infrastructure disruption or mass data theft was reported, the breach eroded diplomatic trust, risked leaking sensitive negotiation details, and could have manipulated geopolitical outcomes—particularly the Gaza ceasefire process. The attack mirrored Iran’s broader regional espionage strategy, previously seen in operations like the 2023 Albania cyberattack.Dream Security’s AI-driven forensic analysis traced the campaign’s infrastructure, exposing the group’s methods and potential for future disruptions. The incident underscores how cyber operations are weaponizing diplomatic channels, blending cyber warfare with traditional statecraft to achieve strategic influence.