The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
FBI and CISA said Iranian state cyber actors maintained access to an Albanian government network for about a year before launching destructive attacks in July 2022. The joint advisory also describes a second wave in September, along with earlier email access and data exfiltration. The case shows how a long-running intrusion can shift from quiet collection to encryption and disk wiping.
What happened in the cyberattack on Albania?
The FBI and CISA’s September 21, 2022 advisory, AA22-264A, covers destructive cyber activity against Albanian government systems in July and September of that year. The July attack made government websites and services unavailable. The actors used a ransomware-style encryptor and disk-wiping malware; the agencies say that after defenders identified and began responding to ransomware, the attackers deployed a version of the destructive malware ZeroCleare.
| Wave | What the agencies reported |
|---|---|
| July 2022 | The destructive attack disrupted government websites and services. The actors used encryption and wiping malware, and publicly claimed credit under the name HomeLand Justice. |
| September 2022 | A further wave used similar tactics and malware. The advisory linked its timing closely to Albania’s public attribution of the July attack and its severing of diplomatic ties with Iran. |
The agencies described the September activity as similar to the July operation, not necessarily identical. HomeLand Justice publicized information it said came from Albanian government systems, posted videos, and used social accounts to promote and release material. According to the advisory, the group solicited followers’ views on what to release, then shared selected information in archives or screen-recorded videos.
Who did officials say was behind the attacks?
FBI and CISA described the operators as Iranian state cyber actors and reported that they used the name “HomeLand Justice.” That is the agencies’ characterization of the actors and the name the group used publicly; it is not, by itself, proof that every public claim made by the group was accurate.
#1 Best Overall
The U.S. Department of the Treasury made a separate attribution assessment in its September 9, 2022 announcement: it said the actors behind the July disruption were sponsored by Iran and its Ministry of Intelligence and Security (MOIS). Treasury also said MOIS cyber actors were responsible for leaking documents purported to be from the Albanian government and personal information associated with Albanian residents. These are Treasury’s assessments and statements, distinct from the wording of the joint FBI/CISA advisory.
Treasury Under Secretary for Terrorism and Financial Intelligence Brian E. Nelson said: “Iran’s cyber attack against Albania disregards norms of responsible peacetime State behavior in cyberspace, which includes a norm on refraining from damaging critical infrastructure that provides services to the public.”
How did the attackers compromise and move through the network?
The FBI investigation, as summarized in AA22-264A, found that initial access came through exploitation of an internet-facing Microsoft SharePoint server using CVE-2019-0604. The estimated gap between that initial access and the destructive attack was about 14 months. The advisory describes the following sequence:
| Stage | Reported activity |
|---|---|
| Initial access and persistence | Attackers exploited the exposed SharePoint server and used ASPX webshells, including pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain access. |
| Network movement | They moved through the victim network primarily with Remote Desktop Protocol (RDP), and also used Server Message Block (SMB) and File Transfer Protocol (FTP). |
| Email access and collection | A compromised Microsoft Exchange account was used to search mailboxes, including administrator mailboxes, and create an account added to the Organization Management role group. About eight months after initial compromise, the FBI observed thousands of HTTP POST requests to the victim’s Exchange servers. It reported roughly 70–160 MB transferred by the client and roughly 3–20 GB transferred by the server during this observed activity. |
| Reconnaissance and credentials | About 12–14 months after initial access, attackers connected to the victim’s VPN appliance, primarily through two compromised accounts. The FBI found use of Advanced Port Scanner and evidence of Mimikatz and LSASS dumping. |
| Encryption and wiping | Using RDP to reach a print server, attackers launched Mellona.exe, which propagated the GoXml.exe encryptor and the persistence script win.bat. The encryptor left ransom notes named How_To_Unlock_MyFiles.txt. The disk-wiping tool cl.exe targeted raw disk drives; the FBI described numerous RDP connections to other hosts over roughly eight hours. |
The FBI characterized the actors as having continuous access for about a year, with periodic access to and exfiltration of email. The Exchange transfer volumes above are measurements from this investigation, not a benchmark for what to expect in other incidents.
What did CISA and the FBI recommend after the attack?
The advisory’s recommendations address different parts of the attack path. They are organizational security practices, not an endorsement of any single product.
Rank #3
Close exposed entry points
- Apply security updates promptly, prioritizing vulnerabilities known to be exploited, and maintain a vulnerability management program.
- Secure internet-facing devices, remove unnecessary services and open ports, and keep anti-virus and anti-malware protections enabled and updated.
Look for collection and suspicious activity
- Monitor Exchange for unusual activity, including unexpectedly large data transfers.
- Use network and endpoint reputation services, and check hosts for suspicious files and webshells.
Limit movement between systems
- Micro-segment networks so an intruder reaching one system has fewer paths to other critical systems.
- Restrict access to trusted users and devices, and enforce phishing-resistant multifactor authentication (MFA) for all users and VPN connections.
Prepare to respond and recover
- Maintain an incident response plan and test it so teams know how to investigate, contain, and recover from an intrusion.
What does the 2022 advisory establish about activity today?
AA22-264A and Treasury’s announcement document agency findings and assessments about activity in 2022. They do not establish whether HomeLand Justice remains active, whether historical indicators are still in use, or the current status of related infrastructure. The advisory remains useful as a defensive case study, but its account of past activity should not be read as confirmation of a current campaign.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
