DEV-0842

DEV-0842 is a Microsoft temporary designation for the Iranian threat actors behind the July 2022 destructive cyberattack against Albanian government infrastructure, later formally attributed to IRGC and MOIS operators acting under the Homeland Justice persona. Microsoft attributed the attack based on the use of ZeroCleare wiper malware combined with ransomware as a cover for destruction, and noted the operators had maintained access to Albanian networks for months before deploying the payload. The DEV-0842 designation has since been retired as the activity was formally attributed to Iran's state intelligence apparatus.