MITRE ATT&CKcampaign

C0038 HomeLand Justice

Published 2024-08-06 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.1
Created
2024-08-06

Description

HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the "HomeLand Justice" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including HEXANE who probed victim infrastructure. A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.

Related

Attributed to · MITRE ATT&CK (1)

  • G1055 VOID MANTICORE group

Uses · MITRE ATT&CK (32)

  • T1685 Disable or Modify Tools technique
  • T1685.001 Disable or Modify Windows Event Log sub-technique
  • S1150 ROADSWEEP software (malware)
  • S1151 ZeroCleare software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • T1588.002 Tool sub-technique
  • T1588.003 Code Signing Certificates sub-technique
  • T1078.001 Default Accounts sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1087.003 Email Account sub-technique
  • T1561.002 Disk Structure Wipe sub-technique
  • T1114.002 Remote Email Collection sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1098.002 Additional Email Delegate Permissions sub-technique
  • T1505.003 Web Shell sub-technique
  • S0364 RawDisk software (tool)
  • T1486 Data Encrypted for Impact technique
  • S0357 Impacket software (tool)
  • T1190 Exploit Public-Facing Application technique
  • S0002 Mimikatz software (tool)
  • S0095 ftp software (tool)
  • T1041 Exfiltration Over C2 Channel technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
Show all 32 ›

References