The FBI and CISA release a Cybersecurity Advisory detailing Iranian state actors, operating as HomeLand Justice, conducting destructive cyber operations against the Government of Albania in July and September 2022, including a year-long intrusion, ransomware-style encryption, and wiper activity. The report covers observed attack progress, from initial access to execution, appendices with technical IOCs, and recommended mitigations such as patching exploited CVEs, MFA, and zero-trust adoption. Hashtags: #HomeLandJustice #Albania #GoXML
Keypoints
- Iranian state actors, identified as “HomeLand Justice,” conducted a destructive cyber campaign against the Government of Albania, including ransomware-style encryption and disk wiping activities.
- Initial access was gained via exploitation of an Internet-facing SharePoint (CVE-2019-0604) about 14 months before encryption and wiper activities.
- Persistence and lateral movement relied on web shells (.aspx: pickers.aspx, error4.aspx, ClientBin.aspx) and common protocols (RDP, SMB, FTP).
- Exchange Server compromise involved abusing a compromised account to run mailbox searches and create a new Exchange account added to Organization Management; later, large-scale data exfiltration via Exchange workflows occurred.
- GoXML.exe acted as a ransomware-style encryptor; files were encrypted with a .lck extension and a ransom note How_To_Unlock_MyFiles.txt was left behind; a separate Disk Wiper (cl.exe and rwdsk.sys) destroyed raw disk data.
- Adversaries posted anti-MEK messages online, claimed credit, and used social media to disseminate government information, indicating political motivation and retaliation for attribution.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Initial access obtained via exploitation of an Internet-facing SharePoint, exploiting CVE-2019-0604. “Initial access was obtained via exploitation of an Internet-facing Microsoft SharePoint, exploiting CVE-2019-0604.”
- [T1505.003] Web Shell – Persistence via web shells; “the actors used several .aspx webshells, pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.”
- [T1021] Remote Services – Lateral movement using RDP (primarily), SMB, and FTP. “During this timeframe, the actors also used RDP (primarily), SMB, and FTP for lateral movement throughout the victim environment.”
- [T1136] Create Account – Exchange account creation as a privileged user. “the compromised account to create a new Exchange account and add it to the Organization Management role group.”
- [T1114] Email Collection – Mailbox searches and data exposure via Exchange; data transfer observed. “Searches on various mailboxes … The FBI observed the client transferring roughly 70-160 MB of data, and the server transferring roughly 3-20 GB of data.”
- [T1033] Credential Dumping (via Mimikatz) – Credential access through credential dumping tools. “Mimikatz usage and LSASS dumping.”
- [T1562.001] Disable or Modify Tools – Impair defenses by disabling Windows Defender. “Disable Defender” components and registry changes observed.
- [T1486] Data Encrypted for Impact – Encrypting files with GoXML.exe and leaving ransom notes. “GoXML.exe encrypted all files … leaving behind a ransom note titled How_To_Unlock_MyFiles.txt.”
- [T1485] Data Destruction – Disk wipe operations using cl.exe and rwdsk.sys. “Disk Wiper tool (cl.exe) … raw disk drives being wiped.”
- [T1133] External Remote Services – Use of VPN and compromised VPN accounts to access the victim network. “Approximately twelve months after initial access … connections to IP addresses belonging to the victim organization’s VPN appliance.”
Indicators of Compromise
- [File Hash] Error4.aspx – 81e123351eb80e605ad73268a5653ff3
- [File Hash] cl.exe – 7b71764236f244ae971742ee1bc6b098
- [File Hash] GoXML.exe – f116acc6508843f59e59fb5a8d643370dce82f492a217764521f46a856cc4cb5
- [File Hash] mellona.exe – 78562ba0069d4235f28efd01e3f32a82
- [File Hash] rwdsk.sys – 3c9dc8ada56adf9cebfc501a2d3946680dcb0534a137e2e27a7fcb5994cd9de6
- [File Name] How_To_Unlock_MyFiles.txt
- [File Name] win.bat
- [File Name] ClientBin.aspx
- [File Name] Pickers.aspx
- [File Name] Error4.aspx
- [File Name] Goxml.jpg
Read more: https://www.cisa.gov/uscert/ncas/alerts/aa22-264a