You're listening to the CyberWire Network, powered by N2K.

This is a SISA Cybersecurity Alert.

ID number Alpha Alpha 22 TAC 264 Alpha.

Original release date, September 21st, 2022.

In July 2022,

in July 2022,

Iranian state cyber actors,

identifying as Homeland Justice, launched a destructive cyber attack

against the government of Albania which rendered websites and services unavailable.

An FBI

investigation indicates Iranian state cyber actors acquired initial access to the

victim's network approximately 14 months before

launching the destructive cyber attack, which included a ransomware style

filing cryptor and disk wiping malware.

The actors maintained continuous network access for approximately a year, periodically accessing and exfiltrating email content.

Between May and June 2022, Iranian state cyber actors conducted lateral movements, network

reconnaissance, and credential harvesting from Albanian government networks.

In July 2022, the actors launched ransomware on the networks.

When network defenders identified and began to respond to the ransomware activity,

the cyber actors deployed a version of zero clear destructive malware.

In June 2022, of Zero Clear destructive malware.

In June 2022, Homeland Justice created a website and multiple social media profiles

...