Homeland Justice Cluster

Homeland Justice is an Iranian hacktivist persona and threat cluster used to conduct disruptive cyberattacks primarily against Albania. The group is linked to the IRGC and gained international prominence in July and September 2022 when it launched destructive wiper attacks against Albanian government infrastructure, resulting in the unprecedented expulsion of Iranian diplomats from Albania.

Targets and Goals

Homeland Justice's primary documented target has been Albania, which hosts the Mojahedin-e Khalq (MEK) — an Iranian opposition group — at its Camp Ashraf 3 facility. The attacks are directly tied to Iran's campaign against MEK infrastructure and its supporters. In July 2022, the group disrupted Albanian government websites and services; a follow-up attack in September 2022 targeted the Albanian border control and national police systems. Albania attributed both attacks to Iran and severed diplomatic relations in response — a rare and significant geopolitical consequence of a cyberattack.

Tooling and Tactics

Microsoft attributed the July 2022 attack to DEV-0842, a cluster later formally linked to IRGC and Ministry of Intelligence (MOIS) operators. The attackers used the ZeroCleare wiper alongside ransomware as a cover for destruction. Access was gained months before the destructive payload was deployed, suggesting extended pre-positioning. The September 2022 follow-up attack hit Albanian State Police systems using similar wiper tooling.

Broader Context

Homeland Justice operations illustrate Iran's use of destructive cyber operations as a foreign policy tool — specifically against countries that host or support Iranian opposition groups. The Albania attacks represent the first known case of a cyberattack directly triggering the expulsion of a nation's diplomatic mission.