The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have stated that one of the Iranian hacker groups that attacked Albanian government servers had continuous access to the network for about a year.
"The Government of Albania was the target of a malicious cyber attack in July 2022 by Iranian state actors operating online under the name "Homeland Justice", which rendered websites and services inaccessible. According to an FBI investigation, Iranian state-sponsored cybercriminals first gained access to the network about 14 months before launching the catastrophic cyberattack that included malware that wiped the victim's hard drive and ransomware-style file encryption.
The actors had continuous access to the network for about a year, periodically accessing and stealing email information. Iranian cyber state actors conducted lateral maneuvers, network reconnaissance, and credential harvesting on Albanian government networks between May and June 2022.
The attackers transmitted malware over networks in July 2022 and placed a message on computers criticizing Mujahideen E-Khalq (MEK). They released a harmful variant of the ZeroCleare virus when network defenses became aware and began to respond to ransomware activity.
To spread disinformation about the MEK, Homeland Justice created a website and multiple social media accounts in June 2022. Homeland Justice claimed responsibility for hacking Albanian government infrastructure on July 18, 2022. Homeland Justice uploaded video of the cyber attack. on their website on July 23, 2022.
From late July to mid-August 2022, social media accounts associated with HomeLand Justice repeatedly promoted the release of Albanian government documents, asked respondents to choose which documents they wanted HomeLand Justice to release, and then published those documents on a.zip or a video of a screen recording with the documents displayed.
Iranian cyber attackers continued to target the Albanian government in September 2022 using malware and TTPs similar to those used in the July operations. These obviously happened as revenge for the interruption of diplomatic relations between Albania and Iran, as well as for the public blame for the hacking in July," the statement says.