HomeLand Justice

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the "HomeLand Justice" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including HEXANE who probed victim infrastructure.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022) A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.(Citation: CISA Iran Albanian Attacks September 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

VOID MANTICORE

Attribution confidence

Not established

First documented activity

2021-05-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2021-05-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-09-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1486 · Data Encrypted for Impact

  Impact — During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1561.002 · Disk Structure Wipe

  Impact — During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.(Citation: CISA Iran Albanian Attacks September 2022)

• T1046 · Network Service Discovery

  Discovery — During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1098.002 · Additional Email Delegate Permissions

  Persistence, Privilege Escalation — During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1134.001 · Token Impersonation/Theft

  Stealth, Privilege Escalation — During HomeLand Justice, threat actors used custom tooling to acquire tokens using `ImpersonateLoggedOnUser/SetThreadToken`.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1078.001 · Default Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1114.002 · Remote Email Collection

  Collection — During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.(Citation: CISA Iran Albanian Attacks September 2022)

• T1190 · Exploit Public-Facing Application

  Initial Access — For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.(Citation: CISA Iran Albanian Attacks September 2022)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1588.003 · Code Signing Certificates

  Resource Development — During HomeLand Justice, threat actors used tools with legitimate code signing certificates. (Citation: CISA Iran Albanian Attacks September 2022)

• T1685 · Disable or Modify Tools

  Defense Impairment — During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1003.001 · LSASS Memory

  Credential Access — During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.(Citation: CISA Iran Albanian Attacks September 2022)

• T1059.003 · Windows Command Shell

  Execution — During HomeLand Justice, threat actors used Windows batch files for persistence and execution.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Mandiant ROADSWEEP August 2022)

• T1505.003 · Web Shell

  Persistence — For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During HomeLand Justice, threat actors used SMB for lateral movement.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.(Citation: CISA Iran Albanian Attacks September 2022)

• T1047 · Windows Management Instrumentation

  Execution — During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1059.001 · PowerShell

  Execution — During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1105 · Ingress Tool Transfer

  Command And Control — During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1087.003 · Email Account

  Discovery — During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.(Citation: CISA Iran Albanian Attacks September 2022)

• T1588.002 · Tool

  Resource Development — During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)

• T1685.001 · Disable or Modify Windows Event Log

  Defense Impairment — During HomeLand Justice, threat actors deleted Windows events and application logs.(Citation: Microsoft Albanian Government Attacks September 2022)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.(Citation: CISA Iran Albanian Attacks September 2022)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0038

  Official MITRE ATT&CK campaign record C0038. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.