MITRE ATT&CKsoftware (malware)
S1151 ZeroCleare
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- ZEROCLEAR
- Version
- 1.0
- Created
- 2024-08-08
Description
ZeroCleare is a wiper malware that has been used in conjunction with the RawDisk driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.
Related
Uses · MITRE ATT&CK (8)
- T1680 Local Storage Discovery technique
- T1059.001 PowerShell sub-technique
- T1561.002 Disk Structure Wipe sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1059 Command and Scripting Interpreter technique
- T1068 Exploitation for Privilege Escalation technique
- T1106 Native API technique
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a CISA Iran Albanian Attacks September 2022
- https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/ Mandiant ROADSWEEP August 2022
- https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/ IBM ZeroCleare Wiper December 2019
- https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/ Microsoft Albanian Government Attacks September 2022