Homeland Justice Wiper Attack Targets Albanian Telecoms and Government
- Actor Motivations: Sabotage
- Attack Vectors: Malware,Wiper
- Attack Complexity: Medium
- Threat Risk: High Impact/High Probability
Threat Overview
The Iranian psychological operation group "Homeland Justice" launched a destructive cyberattack targeting Albanian organizations on December 24, 2023. Utilizing a "No-justice" wiper, the group attacked telecom, airline, and government sectors, including ONE Albania, Eagle Mobile Albania, Air Albania, and the Albanian parliament. The attacks were facilitated by malware delivered through PowerShell scripts and executables, employing tools like Plink, RevSocks, and the W2K Res Kit for lateral movement and system manipulation. The campaign, which included methods to give malware an appearance of legitimacy, threatens to extend beyond Albania, indicating a broader geopolitical motive.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Case | Air Albania Air Albania is the flag carrier of Albania. The airline maintains its hub and company headquarters at the Tirana International Airport Nënë Tereza in Tirana, Albania. Founded in 2018, it operates scheduled air services for passengers to six destinations in Europe. Air Albania has been targeted by Homeland Justice as the main target. | Verified |
| Case | Attest Inspection Limited Attest Inspection Limited has been targeted by Homeland Justice with abusive purposes. | Verified |
| Case | Eagle Mobile Eagle Mobile is a former brand name of ALBtelecom based in Albania and, starting from August 2017, it became known as ALBtelecom Mobile. Eagle Mobile has been targeted by Homeland Justice as the main target. | Verified |
| Case | Kuwait Telecom Company abused (digital signature) Kuwait Telecom Company has been targeted by Homeland Justice with abusive purposes. | Verified |
| Case | ONE Albania One Albania sh.a is a telecommunications company that operates in Albania. It was founded as Albanian Mobile Communications and was part of the COSMOTE Group since 2000. In 2015, the company joined the Deutsche Telekom group after which it was rebranded as Telekom Albania. ONE Albania has been targeted by Homeland Justice as the main target. | Verified |
| Case | Parliament of Albania The Parliament of Albania or Kuvendi is the unicameral representative body of the citizens of the Republic of Albania; it is Albania's legislature. Parliament of Albania has been targeted by Homeland Justice as the main target. | Verified |
| Sector | Government Agencies and Services | Verified |
| Sector | Aerospace | Verified |
| Sector | Telecommunication | Verified |
| Region | Albania | Verified |
Extracted IOCs
- 6b09fb33bfe9c9cb20cb08d2f1aadb89
- 4b80478091b204e76ecdfffa275637bb1b98d103
- 4e265736eaa201e270d851074878dfa60259e806
- 720c467046514f7376473b11271ebcb8d0a7e439
- a973e19aafa2de9ae63964e1fa06a8671eec91e7
- be70fc2d12433899f273dad8c580c96e62c6904b
- c5d38822b42a848a500ccf7cede470f5baa92253
- ffa757edc725a21bb27c09cffe371a7892698c1b
- 36cc72c55f572fe02836f25516d18fed1de768e7f29af7bdf469b52a3fe2531f
Tip: 9 related IOCs (0 IP, 0 domain, 0 URL, 0 email, 9 file hash) to this threat have been found.
Overlaps
Source: Elemental X - December 2023
Detection (one case): 36cc72c55f572fe02836f25516d18fed1de768e7f29af7bdf469b52a3fe2531f
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
Homeland Justice Cyberattacks on Albanian Infrastructure
On December 24 and 25, 2023, cyber attackers successfully breached the computer networks of several major Albanian organizations. Instead of stealing information for financial gain, the attackers deployed a destructive software program that permanently wiped the data on these computer systems.
The attack was carried out by a group known as "Homeland Justice." Security agencies have identified this group as an Iranian state-sponsored threat actor that has been conducting cyberattacks against Albanian targets since the summer of 2022.
This was a destructive psychological operation designed to cause maximum disruption and send a political message. The primary goal was to permanently destroy computer systems and cripple the operations of the targeted organizations as an act of retaliation.
The attacks heavily impacted critical national infrastructure within the Republic of Albania, causing widespread digital damage. However, cybersecurity researchers warn that the tools and methods used in this campaign could be repurposed to threaten organizations in other countries.
Yes, the attackers specifically targeted the Albanian parliament, the national airline (Air Albania), and major telecommunications companies. The group stated they targeted these entities because Albania hosts members of an Iranian opposition group in the city of Durrës.
The attackers gained high-level administrative access to the victims' networks and used automated scripts to silently spread a destructive wiping tool to multiple computers. Once activated, this tool deleted the core startup instructions on the hard drives, causing the computers to crash immediately and preventing them from ever turning back on.
Telecommunications, airlines, and government parliaments are highly visible pillars of a functioning society. By successfully crippling these specific entities, the attackers can cause significant public panic, disrupt daily life, and effectively amplify their political message.
Organizations should closely monitor their networks for unauthorized remote access tools and strictly limit who has administrative control over their computer systems. Additionally, security teams should update their defensive software to block the specific fraudulent digital certificates the attackers used to hide their software.
Currently, this specific campaign is highly targeted against Albanian infrastructure and government entities. However, the tactics and destructive software used in the attack are sophisticated and could easily be directed at other organizations globally if the attackers shift their focus.