threatintel
actor tracker
Homeland Justice
Compromiseseverity: Critical2022-07-15

Iran's Homeland Justice persona destructively attacks Albanian government

published by CISA
Actor
Homeland JusticeIR · IranHacktivist

Public-facing hacktivist persona operated by the Iranian MOIS-affiliated Void Manticore cluster, used for the July 2022 destructive intrusion of the Albanian government's central IT infrastructure. T…

Summary

On 15 July 2022, the Iranian MOIS-affiliated Void Manticore cluster — operating under the Homeland Justice public persona — deployed bespoke wipers (Cl Wiper, No-Justice / LowEraser) against the Albanian government's central IT infrastructure. Initial access was conducted by sister unit Scarred Manticore (Storm-0861) via SharePoint exploitation; Void Manticore then carried out the destructive stage and ran the public-facing leaks. The operation forced multiple Albanian e-government services offline for weeks. **On 7 September 2022 Albanian Prime Minister Edi Rama severed all diplomatic relations with Iran and gave Iranian diplomatic personnel 24 hours to leave** — the first time a NATO member has broken diplomatic ties with another country specifically over a cyber attack.

Tags

wiperdestructivediplomatic-ruptureicsnato-precedentiran

Primary source

cisa.gov